@vzn/vx 0.0.645 → 0.0.648

package/src/cache/git-inputs.ts

@@ -24,6 +24,7 @@ import {
   checkIgnoreSync,
   executablePath,
   gitEnv,
+  gitFailure,
   gitSpawnRefusal,
   isInstalledPath,
   notAWorkTree,
@@ -178,7 +179,12 @@ function repoFactsFromDisk(dir: string): RepoFacts | undefined {
   }
 }
 
-/** `[extensions] objectFormat` of a repository config, sha1 when unset; undefined when unsure. */
+/**
+ * `[extensions] objectFormat` of a repository config, sha1 when unset;
+ * undefined when unsure, or when `core.worktree` puts the work tree
+ * somewhere other than the `.git` directory's parent, which the prefix
+ * read off the disk assumes.
+ */
 function configObjectFormat(config: string): 'sha1' | 'sha256' | undefined {
   let section = ''
   let format: 'sha1' | 'sha256' = 'sha1'
@@ -191,7 +197,10 @@ function configObjectFormat(config: string): 'sha1' | 'sha256' | undefined {
       if (section === 'include' || section === 'includeif') return undefined
       continue
     }
+    if (section === 'core' && /^worktree\b/i.test(line)) return undefined
     if (section !== 'extensions') continue
+    // `config.worktree` may set `core.worktree` too.
+    if (/^worktreeconfig\b/i.test(line)) return undefined
     const kv = /^([A-Za-z0-9-]+)\s*=\s*(.*)$/.exec(line)
     if (kv === null || kv[1]!.toLowerCase() !== 'objectformat') continue
     const value = kv[2]!.toLowerCase()
@@ -204,7 +213,8 @@ function configObjectFormat(config: string): 'sha1' | 'sha256' | undefined {
 interface PartitionDigest {
   snapshot: readonly string[]
   oids: OidSlot | undefined
-  digest: string
+  /** Built on first read: a partition with untrusted files stats them then. */
+  digest: () => string | undefined
 }
 
 /**
@@ -243,6 +253,12 @@ interface IgnoredListing {
 }
 
 export class GitFilesCache extends Map<string, readonly string[]> {
+  /**
+   * vx's own directories inside the workspace (the run's cache directory),
+   * spelled under the workspace root as the run spells it: no input, even
+   * where a glob walks an ignored prefix on disk.
+   */
+  vxDirs: readonly string[] = []
   private changed = new Map<string, string[]>()
   /**
    * Per-project trusted index OIDs: absolute path → git blob OID, for
@@ -303,7 +319,7 @@ export class GitFilesCache extends Map<string, readonly string[]> {
     this.foldCase ??=
       this.vars === null
         ? process.platform === 'darwin'
-        : this.vars.get('core.ignorecase')?.trim().toLowerCase() === 'true'
+        : gitBool(this.vars.get('core.ignorecase')) === true
     return this.foldCase ? abs.toLowerCase() : abs
   }
 
@@ -327,7 +343,7 @@ export class GitFilesCache extends Map<string, readonly string[]> {
 
   /**
    * Whether git tracks a file under `dir`: committed (or `git add`ed)
-   * files are the user's, never cleaned (owner, 2026-10-14: "never
+   * files are the user's, never cleaned (2026-10-14: "never
    * delete committed file"). A directory no enumeration covered (a
    * nested repository, a cache no enumeration filled) is listed once.
    * git lists a submodule as its gitlink path alone, so a file under a
@@ -515,11 +531,20 @@ export class GitFilesCache extends Map<string, readonly string[]> {
     const d = this.digests.get(projectDir)
     if (d === undefined || d.snapshot !== snapshot || this.get(projectDir) !== snapshot) return
     if (this.oids.get(projectDir) !== d.oids || this.changed.has(projectDir)) return
-    return d.digest
-  }
-
-  noteFilesDigest(projectDir: string, snapshot: readonly string[], digest: string): void {
-    this.digests.set(projectDir, { snapshot, oids: this.oids.get(projectDir), digest })
+    return d.digest()
+  }
+
+  noteFilesDigest(
+    projectDir: string,
+    snapshot: readonly string[],
+    digest: () => string | undefined,
+  ): void {
+    let memo: { value: string | undefined } | undefined
+    this.digests.set(projectDir, {
+      snapshot,
+      oids: this.oids.get(projectDir),
+      digest: () => (memo ??= { value: digest() }).value,
+    })
   }
 
   /** Trusted index OIDs for a project (abs path → oid), if any survive. */
@@ -541,12 +566,34 @@ export class GitFilesCache extends Map<string, readonly string[]> {
     const snap = this.get(projectDir)
     if (snap === undefined) return undefined
     const pending = this.changed.get(projectDir)
-    if (pending !== undefined && pending.some((p) => inputGlobs.some((g) => g.match(p)))) {
-      return undefined
-    }
+    if (pending !== undefined && this.pendingMatch(pending, inputGlobs)) return undefined
     return snap
   }
 
+  /**
+   * How far each glob has read a `changed` list, -1 once it matched: the
+   * list only grows until a reset replaces it, so each glob reads each path
+   * once. Every task asked again from the start: 9000 tasks writing into
+   * one project cost 10 s of reads (2026-10-25).
+   */
+  private readonly read = new WeakMap<readonly string[], Map<Bun.Glob, number>>()
+
+  private pendingMatch(pending: readonly string[], globs: readonly Bun.Glob[]): boolean {
+    let upTo = this.read.get(pending)
+    if (upTo === undefined) this.read.set(pending, (upTo = new Map()))
+    for (const g of globs) {
+      let i = upTo.get(g) ?? 0
+      if (i < 0) return true
+      for (; i < pending.length; i++)
+        if (g.match(pending[i]!)) {
+          upTo.set(g, -1)
+          return true
+        }
+      upTo.set(g, i)
+    }
+    return false
+  }
+
   override set(key: string, value: readonly string[]): this {
     this.changed.delete(key)
     this.oids.delete(key)
@@ -645,12 +692,12 @@ const LS_FILES_STAGE_RE = /^(?:([A-Za-z]) )?([0-7]{6}) ([0-9a-f]{40,64}) ([0-3])
  * tree; vx requires git. `-z` survives filenames with newlines /
  * spaces.
  */
-export function runGitLsFiles(cwd: string): GitLsResult {
+export function runGitLsFiles(cwd: string, env = gitEnv()): GitLsResult {
   let proc
   try {
     proc = Bun.spawnSync({
       cmd: [executablePath('git'), 'ls-files', '-s', '--others', '--exclude-standard', '-z', '.'],
-      env: gitEnv(),
+      env,
       cwd,
       stdout: 'pipe',
       stderr: 'pipe',
@@ -659,9 +706,9 @@ export function runGitLsFiles(cwd: string): GitLsResult {
     throw gitSpawnRefusal(cwd)
   }
   if (proc.exitCode !== 0) {
-    // Exit 128 = not a git work tree; other non-zero = git failure.
-    // Either way we can't enumerate inputs reliably.
-    throw notAWorkTree(cwd, new TextDecoder().decode(proc.stderr).trim())
+    // Not a work tree, or git failing in one: either way the inputs
+    // cannot be enumerated, and the two have different fixes.
+    throw gitFailure(cwd, 'ls-files', proc.exitCode, new TextDecoder().decode(proc.stderr).trim())
   }
   const { text, undecodable } = decodeGitZ(proc.stdout)
   const parsed = parseLsFilesOutput(text.length === 0 ? [] : text.split('\0'), undecodable)
@@ -674,7 +721,9 @@ export function runGitLsFiles(cwd: string): GitLsResult {
 /**
  * The files git tracks under `dir`, absolute: one `ls-files` of the index,
  * no worktree walk. Outside a work tree (an embedder's temp dir) nothing
- * is tracked.
+ * is tracked. A git that fails otherwise refuses: read as "nothing
+ * tracked", every committed file under `dir` was the output clean's to
+ * delete (2026-10-28).
  */
 function listTracked(dir: string): string[] {
   let proc
@@ -687,9 +736,16 @@ function listTracked(dir: string): string[] {
       stderr: 'pipe',
     })
   } catch {
-    return []
+    throw gitSpawnRefusal(dir)
+  }
+  if (proc.exitCode !== 0) {
+    const stderr = new TextDecoder().decode(proc.stderr).trim()
+    if (/not a git repository/i.test(stderr)) return []
+    throw new UserError(
+      `git ls-files failed (exit ${proc.exitCode}) in ${dir}: ${stderr || 'no output'}. Run it there to see why.`,
+      'VX_E_GIT',
+    )
   }
-  if (proc.exitCode !== 0) return []
   const { text } = decodeGitZ(proc.stdout)
   return text
     .split('\0')
@@ -732,13 +788,67 @@ function expandNestedRepos(
       for (const f of walkFiles(abs)) out.push(`${nested}/${f}`)
       continue
     }
-    const inner = runGitLsFiles(abs)
+    let inner
+    try {
+      inner = runGitLsFiles(abs, nestedRepoEnv())
+    } catch {
+      // A `.git` git cannot open (a submodule's file naming a lost
+      // `.git/modules` entry) answers as no `.git` does: by a walk. It
+      // refused the whole run as "not inside a git work tree".
+      for (const f of walkFiles(abs)) out.push(`${nested}/${f}`)
+      continue
+    }
     for (const f of inner.files) out.push(`${nested}/${f}`)
     for (const f of inner.undecodable) undecodable.push(`${nested}/${f}`)
   }
   return { files: out ?? files, undecodable }
 }
 
+/**
+ * Variables that name the repository git works on (git's `local_repo_env`),
+ * which a nested repository's git must not inherit. A pre-commit hook runs
+ * vx with `GIT_INDEX_FILE` or `GIT_DIR` naming the OUTER repository, and
+ * the nested listing read the outer index: a file the nested repository
+ * tracks under an ignore rule fell out of the inputs, a stale hit. git
+ * clears the same list for a submodule's commands; config variables stay.
+ */
+const LOCAL_REPO_ENV = new Set([
+  'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+  'GIT_COMMON_DIR',
+  'GIT_DIR',
+  'GIT_GRAFT_FILE',
+  'GIT_IMPLICIT_WORK_TREE',
+  'GIT_INDEX_FILE',
+  'GIT_INTERNAL_SUPER_PREFIX',
+  'GIT_NO_REPLACE_OBJECTS',
+  'GIT_OBJECT_DIRECTORY',
+  'GIT_PREFIX',
+  'GIT_REPLACE_REF_BASE',
+  'GIT_SHALLOW_FILE',
+  'GIT_WORK_TREE',
+])
+
+function nestedRepoEnv(): Record<string, string> {
+  const env = gitEnv()
+  for (const name of LOCAL_REPO_ENV) delete env[name]
+  return env
+}
+
+/**
+ * The environment a listing of `dir` runs in: `nestedRepoEnv` when a
+ * location variable is set and `dir` sits in a repository nested below
+ * `workspaceRoot` (a `.git` at it or between), whose git must not read the
+ * workspace repository's index; git's own environment otherwise.
+ */
+export function listingEnv(dir: string, workspaceRoot: string): Record<string, string> {
+  if (![...LOCAL_REPO_ENV].some((name) => process.env[name] !== undefined)) return gitEnv()
+  for (let at = dir; at !== workspaceRoot && at.startsWith(workspaceRoot); at = path.dirname(at)) {
+    if (existsSync(path.join(at, '.git'))) return nestedRepoEnv()
+    if (path.dirname(at) === at) break
+  }
+  return gitEnv()
+}
+
 /** Every file and symlink under `dir`, relative and `/`-separated; a `.git` is skipped, a link not followed. */
 function walkFiles(dir: string, rel = ''): string[] {
   let entries
@@ -1206,10 +1316,30 @@ function gitVarList(listing: string): Map<string, string> {
   for (const line of listing.split('\n')) {
     const eq = line.indexOf('=')
     if (eq > 0) vars.set(line.slice(0, eq), line.slice(eq + 1))
+    // A bare key (`[core] fileMode` with no `=`) is listed without one, and
+    // git reads it as true.
+    else if (eq === -1 && /^[a-z]+\./i.test(line)) vars.set(line, 'true')
   }
   return vars
 }
 
+/**
+ * A boolean config value as git reads it: `true`/`yes`/`on`, `false`/
+ * `no`/`off` and the empty value, or an integer (`k`/`m`/`g` suffix
+ * allowed) that is true when nonzero. Only `false`/`no`/`off`/`0` were
+ * taken, so `trustctime =` or `fileMode = 00` kept index OIDs trusted
+ * while git judged by the weaker stat. Undefined when unset or not a
+ * boolean git takes.
+ */
+function gitBool(v: string | undefined): boolean | undefined {
+  if (v === undefined) return undefined
+  const t = v.trim().toLowerCase()
+  if (t === 'true' || t === 'yes' || t === 'on') return true
+  if (t === 'false' || t === 'no' || t === 'off' || t === '') return false
+  const n = /^([-+]?\d+)[kmg]?$/.exec(t)
+  return n === null ? undefined : Number(n[1]) !== 0
+}
+
 /**
  * `true` when git ignores the executable bit (`core.fileMode=false`, the
  * default on WSL's DrvFs and what `git init` writes on a filesystem without
@@ -1217,8 +1347,7 @@ function gitVarList(listing: string): Map<string, string> {
  * says nothing about the worktree.
  */
 function fileModeIgnored(gitVars: string): boolean {
-  const v = gitVarList(gitVars).get('core.filemode')?.trim().toLowerCase()
-  return v === 'false' || v === 'no' || v === 'off' || v === '0'
+  return gitBool(gitVarList(gitVars).get('core.filemode')) === false
 }
 
 /**
@@ -1255,21 +1384,14 @@ function restampModes(trusted: Map<string, string>, workspaceRoot: string): void
  */
 export function gitStatWeakened(gitVars: string): boolean {
   const vars = gitVarList(gitVars)
-  const trustctime = vars.get('core.trustctime')?.trim().toLowerCase()
   const checkStat = vars.get('core.checkstat')?.trim().toLowerCase()
-  return (
-    trustctime === 'false' ||
-    trustctime === 'no' ||
-    trustctime === 'off' ||
-    trustctime === '0' ||
-    checkStat === 'minimal'
-  )
+  return gitBool(vars.get('core.trustctime')) === false || checkStat === 'minimal'
 }
 
 /** `true` when git may rewrite bytes for EVERY auto-detected text file. */
 export function autocrlfConverts(gitVars: string): boolean {
-  const v = gitVarList(gitVars).get('core.autocrlf')?.trim().toLowerCase()
-  return v === 'true' || v === 'input'
+  const v = gitVarList(gitVars).get('core.autocrlf')
+  return v?.trim().toLowerCase() === 'input' || gitBool(v) === true
 }
 
 /**
@@ -1423,6 +1545,8 @@ export interface GitEnumeration {
   scopes: readonly string[]
   /** Workspace-relative path → index OID, for files whose worktree state matched the index. */
   trusted: Map<string, string>
+  /** Tracked paths git does not look at on disk (assume-unchanged, skip-worktree), workspace-relative. */
+  flagged: readonly string[]
   /** Whether the worktree had uncommitted changes; null when `git status` failed. */
   dirty: boolean | null
   /** `git var -l`'s listing (merged config, then git's variables); null when it failed. */
@@ -1505,6 +1629,19 @@ function hasRacyEntry(index: Uint8Array, mtimeSec: number, oidBytes: number): bo
 /** A private copy a run older than this may still have handed to `status`. */
 const STALE_INDEX_MS = 60_000
 
+/** Whether `status` should read a refreshed copy of the index (`refreshedIndex`). */
+function racyIndex(
+  read: { bytes: Uint8Array; st: Stats },
+  objectFormat: 'sha1' | 'sha256',
+): boolean {
+  if (GIT_LOCATION_ENV.some((name) => process.env[name] !== undefined)) return false
+  return hasRacyEntry(
+    read.bytes,
+    Math.floor(read.st.mtimeMs / 1000),
+    objectFormat === 'sha256' ? 32 : 20,
+  )
+}
+
 /**
  * The index `status` reads when the real one holds a racily clean entry: a
  * copy refreshed once and kept beside it, named by the real index's bytes.
@@ -1517,18 +1654,13 @@ const STALE_INDEX_MS = 60_000
 async function refreshedIndex(
   indexFile: string,
   read: { bytes: Uint8Array; hash: string; st: Stats },
-  objectFormat: 'sha1' | 'sha256',
   spawnGit: (
     args: string[],
     stdin?: string,
     env?: Record<string, string>,
   ) => Promise<GitRun | null>,
 ): Promise<string | undefined> {
-  if (GIT_LOCATION_ENV.some((name) => process.env[name] !== undefined)) return undefined
   const { bytes, hash, st } = read
-  if (!hasRacyEntry(bytes, Math.floor(st.mtimeMs / 1000), objectFormat === 'sha256' ? 32 : 20)) {
-    return undefined
-  }
   const dir = path.dirname(indexFile)
   const name = `vx-index-${hash}`
   const copy = path.join(dir, name)
@@ -1630,15 +1762,6 @@ export async function startGitEnumeration(
     }
   }
   const startedAtMs = Date.now()
-  // Four spawns at most (the rev-parse is memoized per process), one
-  // worktree walk. `ls-files -s -v` reads the INDEX only
-  // (~9 ms on a 1000-project tree) and answers two questions at once: every
-  // tracked path's OID and its cache-state flag. `status -uall` is the one
-  // command that walks the worktree, and it answers two as well: which
-  // tracked paths are dirty AND which files are untracked. Asking
-  // `ls-files --others` for the untracked set walked the same tree a second
-  // time (~50 ms of CPU, concurrent with status but contending with it).
-  const listing = spawnGit(['ls-files', '-s', '-v', '-z', '--', ...pathspecs])
   // The gate for whether a clean filter can rewrite bytes between the
   // index and the worktree: git's merged config (`core.autocrlf`) and,
   // from git 2.42, the attributes files it reads outside the tree
@@ -1647,7 +1770,7 @@ export async function startGitEnumeration(
   // 1.32 ms, min of 30), which could not name the default global file.
   // Not foldable into the rev-parse below: rev-parse prints no config.
   const varsRun = spawnGit(['var', '-l'])
-  // Asked while the two above run, from the memo the file hasher reads
+  // Asked while `var` runs, from the memo the file hasher reads
   // too (`repoFacts`). `prefix` is the repo→workspace path (empty when the
   // workspace root IS the git root): `ls-files` prints cwd(workspace)-
   // relative paths but `status` prints repo-root-relative ones, so when the
@@ -1673,15 +1796,39 @@ export async function startGitEnumeration(
     facts === null || facts.indexFile === ''
       ? undefined
       : path.resolve(workspaceRoot, facts.indexFile)
-  const readIndex = async (): Promise<
-    { bytes: Uint8Array; hash: string; st: Stats; key: string; stamp: string } | undefined
-  > => {
+  // `ls-files` and `status` each read the index on their own. A write
+  // between them (an unstage, a checkout) paired one index's OIDs with the
+  // other's verdict: a `git reset` of a staged edit made the file clean to
+  // `status` while `ls-files` had listed the staged blob, and that blob
+  // keyed the committed bytes on disk. The index is stamped before the
+  // listing and after the status; an index that moved trusts no OID.
+  const indexStamp = (): string | undefined => {
+    if (indexFile === undefined) return undefined
+    const st = lstatSync(indexFile, { throwIfNoEntry: false })
+    return st === undefined ? undefined : `${st.ino}:${st.ctimeMs}:${st.size}`
+  }
+  const stampBefore = indexStamp()
+  // Four spawns at most (the rev-parse is memoized per process), one
+  // worktree walk. `ls-files -s -v` reads the INDEX only
+  // (~9 ms on a 1000-project tree) and answers two questions at once: every
+  // tracked path's OID and its cache-state flag. `status -uall` is the one
+  // command that walks the worktree, and it answers two as well: which
+  // tracked paths are dirty AND which files are untracked. Asking
+  // `ls-files --others` for the untracked set walked the same tree a second
+  // time (~50 ms of CPU, concurrent with status but contending with it).
+  const listing = spawnGit(['ls-files', '-s', '-v', '-z', '--', ...pathspecs])
+  // Read synchronously: `status` spawns once the read is in, and an async
+  // read's answer waited for the main thread to yield, behind the workspace
+  // config and discovery (~5 ms of a 1,200-task warm run's wait for git).
+  const readIndex = ():
+    | { bytes: Uint8Array; hash: string; st: Stats; key: string; stamp: string }
+    | undefined => {
     if (indexFile === undefined) return undefined
     try {
       // Stat before the read: a write between them leaves an mtime older
       // than the bytes, which only makes more entries racy.
       const st = lstatSync(indexFile)
-      const bytes = await Bun.file(indexFile).bytes()
+      const bytes = readFileSync(indexFile)
       const hash = xxh3hex(bytes)
       return {
         bytes,
@@ -1694,38 +1841,33 @@ export async function startGitEnumeration(
       return undefined
     }
   }
-  const indexKeyRead = readIndex()
-  const statusIndex = indexKeyRead.then((read) =>
-    read === undefined || indexFile === undefined
-      ? undefined
-      : refreshedIndex(indexFile, read, facts!.objectFormat, spawnGit),
-  )
-  const running = Promise.all([
-    listing,
-    // `--ignored=matching` names an ignored path without descending into an
-    // ignored directory: git applies an ignored `.gitattributes` as it does
-    // any other, and the filter gate below must see it (A-19).
-    // `--no-renames`: a deletion paired as an unmerged path's rename source
-    // prints only as `UU <path>`, and the deleted file stayed trusted (A-59).
-    statusIndex.then((index) => {
-      const env = index === undefined ? undefined : { GIT_INDEX_FILE: index }
-      return spawnGit(
-        [
-          'status',
-          '--porcelain',
-          '-z',
-          '-uall',
-          '--ignored=matching',
-          '--no-renames',
-          '--',
-          ...pathspecs,
-        ],
-        undefined,
-        env,
-      )
-    }),
-    varsRun,
-  ])
+  const read = readIndex()
+  // `--ignored=matching` names an ignored path without descending into an
+  // ignored directory: git applies an ignored `.gitattributes` as it does
+  // any other, and the filter gate below must see it (A-19).
+  // `--no-renames`: a deletion paired as an unmerged path's rename source
+  // prints only as `UU <path>`, and the deleted file stayed trusted (A-59).
+  const spawnStatus = (index: string | undefined) =>
+    spawnGit(
+      [
+        'status',
+        '--porcelain',
+        '-z',
+        '-uall',
+        '--ignored=matching',
+        '--no-renames',
+        '--',
+        ...pathspecs,
+      ],
+      undefined,
+      index === undefined ? undefined : { GIT_INDEX_FILE: index },
+    )
+  // An index with no racy entry is read as it is: `status` spawns now.
+  const statusRun =
+    read === undefined || indexFile === undefined || !racyIndex(read, facts!.objectFormat)
+      ? spawnStatus(undefined)
+      : refreshedIndex(indexFile, read, spawnGit).then(spawnStatus)
+  const running = Promise.all([listing, statusRun, varsRun])
   const gitPrefix = facts?.prefix ?? ''
   const gitDir = facts?.commonDir ?? ''
   const ls = await listing
@@ -1740,12 +1882,12 @@ export async function startGitEnumeration(
       ? spawnGit(CHECK_ATTR, [...parsedLs.oids.keys()].join('\0'))
       : undefined
   const [, status, vars] = await running
+  const indexMoved = indexStamp() !== stampBefore
   // The key stands for the index `ls-files` listed only when that index
   // was written before the enumeration began (git writes it by rename, so
   // the stamp moves with any write) and is still in place after it: a
   // `git add` between the listing and the read paired one index's verdict
   // with the other's entries. Otherwise this run asks for no verdict.
-  const read = await indexKeyRead
   let indexKey: string | undefined
   if (
     read !== undefined &&
@@ -1761,13 +1903,8 @@ export async function startGitEnumeration(
   if (ls === null) {
     throw gitSpawnRefusal(workspaceRoot)
   }
-  if (parsedLs === undefined) {
-    const stderr = ls.stderr.trim()
-    throw new UserError(
-      `vx requires git: ${workspaceRoot} is not inside a git work tree. ` +
-        `Run 'git init' in your workspace root.${stderr ? ` (git: ${stderr})` : ''}`,
-    )
-  }
+  if (parsedLs === undefined)
+    throw gitFailure(workspaceRoot, 'ls-files', ls.exitCode, ls.stderr.trim())
   const { files: tracked, oids, flagged, gitlinks, undecodable } = parsedLs
   // Normalize `status`'s repo-root-relative paths to workspace-relative (strip
   // the `--show-prefix`) so the dirty set is keyed identically to the trusted
@@ -1798,7 +1935,7 @@ export async function startGitEnumeration(
   // this same status spawn so `run()` needs no second `git status`.
   // null when the status spawn failed (non-repo / git error).
   const worktreeDirty = dirty === null ? null : dirty.size > 0
-  const trusted = dirty === null ? new Map<string, string>() : oids
+  const trusted = dirty === null || indexMoved ? new Map<string, string>() : oids
   if (dirty !== null) {
     for (const rel of dirty) trusted.delete(rel)
   }
@@ -1846,6 +1983,7 @@ export async function startGitEnumeration(
     tracked: gitlinks.size === 0 ? tracked : tracked.concat([...gitlinks]),
     scopes: pathspecs,
     trusted,
+    flagged: [...flagged],
     dirty: worktreeDirty,
     vars: vars !== null && vars.exitCode === 0 ? vars.stdout : null,
     changed: dirty === null ? null : [...dirty, ...untracked],
@@ -1861,6 +1999,10 @@ export async function startGitEnumeration(
       async blobs() {
         const run = await spawnGit(['ls-files', '-s', '-v', '-z', '--debug', '--', ...pathspecs])
         if (run === null || run.exitCode !== 0) return null
+        // Sizes from an index written since the listing judge entries the
+        // trusted OIDs did not come from: an add there rewrote a resized
+        // entry to one that fits, and the listed OID stood (A-60).
+        if (indexStamp() !== stampBefore) return null
         const debug = splitLsDebug(run)
         const indexed = new Map<string, { oid: string; size: number }>()
         parseLsFilesOutput(debug.records, debug.undecodable, { sizes: debug.sizes, indexed })
@@ -1908,6 +2050,30 @@ export function lazyGitEnumeration(workspaceRoot: string): LazyGitEnumeration {
   }
 }
 
+/**
+ * Each loose file's stat identity, `hashFile`'s memo key: mode, size,
+ * mtime, ctime and inode. Undefined for a symlink (what it points to
+ * folds too, and its stat does not move with that), a file gone, or one
+ * changed within the racy window, where the memo trusts no stat either.
+ */
+function statRecords(
+  rels: readonly string[],
+  abs: (rel: string) => string,
+  prefixLength: number,
+): string | undefined {
+  if (rels.length === 0) return ''
+  const now = Date.now()
+  let out = ''
+  for (const rel of rels) {
+    const st = lstatSync(abs(rel), { throwIfNoEntry: false })
+    if (st === undefined || !st.isFile()) return undefined
+    if (now - Math.floor(st.ctimeMs) < racyWindowMs(st.ctimeMs, FILE_HASH_RACY_MS)) return
+    const mode = (st.mode & 0o100) !== 0 ? '100755' : '100644'
+    out += `${rel.slice(prefixLength)}\0stat:${mode}:${st.size}:${Math.floor(st.mtimeMs)}:${Math.floor(st.ctimeMs)}:${Number(st.ino)}\n`
+  }
+  return out
+}
+
 /** The partition half of `populateGitFilesCache`: store per-project slices of one enumeration. */
 export async function applyGitEnumeration(
   enumeration: GitEnumeration,
@@ -2006,15 +2172,20 @@ export async function applyGitEnumeration(
     }
     // One hash of the records joined: one per record was ~25 ms of 125,000.
     let records: string | undefined = ''
+    // A file git vouches for no OID (untracked, or changed since the
+    // index) is named by its stat instead, the identity `hashFile`'s memo
+    // trusts: a just-added config or an edited file turned the fold memo
+    // off for its whole project (+3-5 ms of solid's warm run, 2026-10-22).
+    const loose: string[] = []
     for (let i = start; i < end; i++) {
       const rel = sorted[i]!
       const own = rel.slice(prefix.length)
       matches.push(own)
       if (records === undefined) continue
       const oid = trusted.get(rel)
-      if (oid === undefined || oid.startsWith('120000:') || undecodable?.has(rel) === true) {
-        records = undefined
-      } else records += `${own}\0${oid}\n`
+      if (undecodable?.has(rel) === true || oid?.startsWith('120000:') === true) records = undefined
+      else if (oid === undefined) loose.push(rel)
+      else records += `${own}\0${oid}\n`
     }
     // An empty slice is a directory git did not see, not an empty project:
     // a project has at least its package.json, tracked or untracked. A
@@ -2033,7 +2204,13 @@ export async function applyGitEnumeration(
     // setLazyOids AFTER set — set() drops the project's OID slot.
     cache.set(projectDir, matches)
     cache.setLazyOids(projectDir, projOids)
-    if (records !== undefined) cache.noteFilesDigest(projectDir, matches, xxh3hex(records))
+    if (records !== undefined) {
+      const known = records
+      cache.noteFilesDigest(projectDir, matches, () => {
+        const statted = statRecords(loose, projAbs, prefix.length)
+        return statted === undefined ? undefined : xxh3hex(`${known}\0${statted}`)
+      })
+    }
   }
   if (workspaceWide) {
     cache.set(workspaceRoot, all)

package/src/cache/index.ts

@@ -29,6 +29,7 @@ export {
   WORKSPACE_OUTPUT_PREFIX,
   type OutputDirRow,
   OUTPUT_DIRS_CAP,
+  OUTPUT_DIRS_OVER_CAP,
   FILE_HASH_RACY_MS,
   OUTPUT_DIRS_RACY_MS,
   racyWindowMs,
@@ -39,7 +40,7 @@ export {
 export { ABSENT_INPUT, absentOr, CACHE_VERSION, foldHead } from './key-fold.js'
 export type { FoldMemo } from './fold-memo.js'
 export { measureFsClockLag, setFsClockLag } from './fs-clock.js'
-export { filesBehind } from './linked-inputs.js'
+export { behindLink, filesBehind } from './linked-inputs.js'
 export {
   addedInput,
   type InputListing,
@@ -54,7 +55,9 @@ export {
   type ResolveInputsArgs,
   resolveOutputTree,
   resolveOutputs,
+  outputWalkTakes,
   resolveWorkspaceOutputs,
+  resolveWorkspaceOutputTree,
   sweepRestoreTemps,
   sweepStaging,
   asTrees,
@@ -66,6 +69,7 @@ export {
   stampOutputs,
   stampWorkspaceOutputs,
   stopRuntimeProbes,
+  answerRuntime,
   type OutputStamp,
 } from './inputs.js'
 export {
@@ -84,10 +88,11 @@ export {
 export {
   type ArtifactInfo,
   LayeredCache,
+  type LentAccess,
   type RemoteCacheLayer,
   type RemoteOpenContext,
 } from './layered-cache.js'
-export { networkConcurrency } from './remote-lane.js'
+export { networkConcurrency, sayRemoteFault } from './remote-lane.js'
 export type { ResolvedRemote } from './remote-lane.js'
 export {
   absentPluginCache,