@vzn/vx 0.0.650 → 0.0.651

package/src/orchestrator/plugin-host.ts

@@ -33,6 +33,7 @@ import type {
   DiscoverContext,
   ExecutorContext,
   FingerprintChange,
+  FingerprintDigests,
   FingerprintContext,
   GraphHookContext,
   KeyHookContext,
@@ -44,6 +45,7 @@ import type {
   ConfigContext,
 } from './plugin.js'
 import type { ProjectMeta } from '../workspace/index.js'
+import { hashExtra } from './lockfile-claim.js'
 
 /** `a string`, `an array`, `null`, `a number` — for a refusal that names what came back. */
 function describeValue(v: unknown): string {
@@ -392,6 +394,65 @@ export async function claimedAffected(
   ctx: FingerprintContext,
 ): Promise<Set<string> | undefined> {
   const answer = await safe(plugin, 'fingerprint', () => plugin.fingerprint!.affected(change, ctx))
+  return projectNames(plugin, answer, ctx)
+}
+
+/**
+ * `FingerprintClaim.digests`' answer for `file`, each extra file it names
+ * with its hash now (`hashExtra`, as a run checks it); `undefined` when the
+ * plugin has none. A digest of a name no project carries, or a value that
+ * is not a string, is refused by name: `vx lock` would commit it.
+ */
+export async function claimedDigests(
+  plugin: VxPlugin,
+  file: string,
+  ctx: FingerprintContext,
+): Promise<
+  | {
+      hash: string
+      projects: FingerprintDigests['projects']
+      extras?: Readonly<Record<string, string>>
+    }
+  | undefined
+> {
+  const digests = plugin.fingerprint?.digests
+  if (digests === undefined) return undefined
+  const answer: unknown = await safe(plugin, 'fingerprint', () =>
+    digests.call(plugin.fingerprint, file, ctx),
+  )
+  if (answer === undefined) return undefined
+  const { hash, projects, extras } = (answer ?? {}) as Partial<FingerprintDigests>
+  if (
+    typeof hash !== 'string' ||
+    typeof projects !== 'object' ||
+    projects === null ||
+    Object.values(projects).some((d) => typeof d !== 'string') ||
+    (extras !== undefined &&
+      (!Array.isArray(extras) || extras.some((rel) => typeof rel !== 'string')))
+  ) {
+    throw new UserError(
+      `plugin '${plugin.name}' failed in fingerprint: digests returned ${describeValue(answer)}, not { hash, projects: { name: digest }, extras?: [path] }`,
+    )
+  }
+  const known = new Set(ctx.projects.map((p) => p.name))
+  const stray = Object.keys(projects).find((n) => !known.has(n))
+  if (stray !== undefined) {
+    throw new UserError(
+      `plugin '${plugin.name}' failed in fingerprint: digest of ${JSON.stringify(stray)}, which is not a project in this workspace`,
+    )
+  }
+  if (extras === undefined || extras.length === 0) return { hash, projects }
+  const hashed = await Promise.all(
+    extras.map(async (rel) => [rel, await hashExtra(ctx.workspaceRoot, rel)] as const),
+  )
+  return { hash, projects, extras: Object.fromEntries(hashed) }
+}
+
+async function projectNames(
+  plugin: VxPlugin,
+  answer: unknown,
+  ctx: FingerprintContext,
+): Promise<Set<string> | undefined> {
   if (answer === undefined) return undefined
   // A plain object is no list: `for…of` threw "is not iterable", naming
   // neither the plugin nor the hook.

package/src/orchestrator/plugin.ts

@@ -27,9 +27,9 @@ import {
   type PluginSecrets,
   SecretBroker,
   thrownMessage,
-  ui,
   UserError,
 } from '../util/index.js'
+import * as ui from '../ui/index.js'
 import type { ProjectMeta } from '../workspace/index.js'
 import type { EventBus, Logger, RunStartInfo } from '../report/index.js'
 import type { CiContext } from './run-context.js'
@@ -460,7 +460,29 @@ export interface GraphHookContext extends BaseContext {
   readonly requested: readonly string[]
 }
 
-export interface KeyHookContext extends BaseContext {}
+export interface KeyHookContext extends BaseContext {
+  /**
+   * What `vx lock` recorded of the claimed `file` in
+   * `.vx/dependencies.lock.json` (`FingerprintClaim.digests`): a run keys
+   * from the record and never parses the file. Undefined when the file is
+   * absent and unrecorded. Refuses, naming `vx lock`, when the lock is
+   * absent or records no such present file; a recorded file whose bytes
+   * moved since refused the run before the key stage.
+   */
+  locked(file: string): Promise<LockedFile | undefined>
+}
+
+/** `KeyHookContext.locked`'s answer. */
+export interface LockedFile {
+  /**
+   * The other files the digests read → each one's hash then (`hashExtra`).
+   * Not checked by core: a `link:` directory is edited with no install,
+   * so a claimant whose extra file moved digests anew.
+   */
+  readonly extras: Readonly<Record<string, string>>
+  /** The project at `projectDir`'s digest; undefined when none. Refuses for a project the lock does not list. */
+  digest(projectDir: string): string | undefined
+}
 
 /** A plugin's claim on workspace-root files — see `VxPlugin.fingerprint`. */
 export interface FingerprintClaim {
@@ -491,6 +513,29 @@ export interface FingerprintClaim {
     bytes: Uint8Array,
     ctx: FingerprintContext,
   ): readonly string[] | Promise<readonly string[]>
+  /**
+   * Each project's digest of the claimed `file` as it is now, by project
+   * name, with `hash`, the xxh3 of the bytes they came from (`xxh3hex`),
+   * and `extras`, the other files they read. `vx lock` records them in
+   * `.vx/dependencies.lock.json` with each extra file's hash; a run keys
+   * from that record (`KeyHookContext.locked`), and `--affected`
+   * reads the base's copy there instead of asking `affected` to parse the
+   * base side, when its `hash` is the base file's xxh3. `undefined`:
+   * nothing to record.
+   */
+  digests?(
+    file: string,
+    ctx: FingerprintContext,
+  ): FingerprintDigests | undefined | Promise<FingerprintDigests | undefined>
+}
+
+/** `FingerprintClaim.digests`' answer. */
+export interface FingerprintDigests {
+  readonly hash: string
+  /** Project name → its digest of the file. */
+  readonly projects: Readonly<Record<string, string>>
+  /** Root-relative files besides `file` whose bytes the digests read (a `bun.lock` patch). */
+  readonly extras?: readonly string[]
 }
 
 export interface FingerprintChange {

package/src/orchestrator/prepare.ts

@@ -39,6 +39,7 @@ import {
   gitPathspecs,
   MAX_SCOPED_PATHSPECS,
   startGitEnumeration,
+  checkBlobSizes,
   lazyGitEnumeration,
   measureFsClockLag,
   DEFAULT_STORE,
@@ -52,6 +53,7 @@ import {
   lockDigest,
   PROJECT_CONFIG_FILENAMES,
   readClaimedFiles,
+  readDependenciesLock,
   resolveCacheDir,
   resolveStoreRoot,
   type ProjectEntry,
@@ -76,6 +78,7 @@ import {
   teardownPlugins,
   type ScheduleRun,
 } from './plugin-host.js'
+import { lockedFiles } from './locked-digests.js'
 import {
   discoverProjects,
   gitOfDiscovery,
@@ -382,6 +385,16 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   const fingerprintsAt = Date.now()
   const claimed = [...fingerprintClaims(plugins).keys()]
   const claimedBytes = await readClaimedFiles(workspaceRoot, claimed, reads)
+  // What `vx lock` recorded of them: a run keys from it (locked-digests.ts).
+  const dependenciesLock = claimed.length > 0 ? readDependenciesLock(workspaceRoot, reads) : null
+  dependenciesLock?.catch(() => {})
+  // A whole-tree run's blob-size check starts with the cache it reads its
+  // verdict from, beside the config load and graph build: after them, a cold
+  // 100-package run waited 40-50 ms on it before its first task (2026-11-03).
+  if (git.started !== undefined) {
+    localCache.holdBlobSizes()
+    git.started.then((e) => checkBlobSizes(e, localCache)).catch(() => {})
+  }
   mark('open cache')
 
   // Configs load FROM .vx/projects.lock.json with no evaluation and no check of
@@ -776,6 +789,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
     // 1,000 projects when it ran before the spawn.
     const settleIgnored = askIgnoredOutputs(gatedOutputs(nodes, workspaceRoot), workspaceRoot)
     const enumeration = await enumerating
+    localCache.holdBlobSizes()
     await applyGitEnumeration(
       enumeration,
       workspaceRoot,
@@ -800,7 +814,8 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
       }
     }
     if (hasHook(plugins, 'key')) {
-      await applyKeyHooks(plugins, nodes, { workspaceRoot, cacheDir, warn: warnOf(log) })
+      const locked = lockedFiles(workspaceRoot, claimed, claimedBytes, await dependenciesLock)
+      await applyKeyHooks(plugins, nodes, { workspaceRoot, cacheDir, warn: warnOf(log), locked })
     }
     refuseFiltersThroughGroups(nodes)
     const exclude = options.excludeDependencies

package/src/orchestrator/projects.ts

@@ -370,8 +370,11 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
         }
         continue
       }
-      const config: ProjectConfig =
+      const frozen: ProjectConfig =
         meta.configPath === null ? { tasks: {} } : (loaded[next++] as ProjectConfig)
+      // The lock shares a task two projects declare alike: an edit in place
+      // works on this project's own copy.
+      const config = projectStage ? structuredClone(frozen) : frozen
       if (projectStage) {
         // The `project` stage edits the validated object in place; core
         // re-validates after EACH plugin so a plugin can only produce what

package/src/orchestrator/run-context.ts

@@ -30,7 +30,7 @@ import type { RunContextRecord } from './telemetry.js'
 export interface GitContext {
   /** `git rev-parse HEAD`, or null outside a repo / on failure. */
   commitSha: string | null
-  /** `git rev-parse --abbrev-ref HEAD`, or null. */
+  /** The branch HEAD names (`refs/heads/` stripped), with or without a commit; null when detached. */
   branch: string | null
   /** True if `git status --porcelain` was non-empty; null on failure. */
   dirty: boolean | null
@@ -61,9 +61,11 @@ export interface HostContext {
 
 /**
  * One short `git` spawn per run (not per task), behind try/catch.
- * `git rev-parse HEAD --abbrev-ref HEAD` returns the commit on line 1
- * and the branch on line 2 in a SINGLE invocation — half the spawns of
- * two separate `rev-parse` calls. `dirty` is NOT probed here: the run's
+ * `git rev-parse HEAD --symbolic-full-name HEAD` returns the commit on
+ * line 1 and the ref on line 2 in a SINGLE invocation — half the spawns
+ * of two separate `rev-parse` calls. The full name, not `--abbrev-ref`:
+ * a tag named like the branch made that answer `heads/main`
+ * (vercel/turborepo#13882). `dirty` is NOT probed here: the run's
  * `GitFilesCache` populate already ran `git status --porcelain` for
  * input enumeration, so the orchestrator passes that aggregate in
  * (`dirty`) rather than paying for a second status spawn. Pass
@@ -95,7 +97,7 @@ export function captureGitContext(
         workspaceRoot,
         'rev-parse',
         'HEAD',
-        '--abbrev-ref',
+        '--symbolic-full-name',
         'HEAD',
       ],
       env: gitEnv(),
@@ -107,15 +109,19 @@ export function captureGitContext(
       const sha = lines[0]?.trim()
       const br = lines[1]?.trim()
       if (sha) commitSha = sha
-      // `--abbrev-ref HEAD` answers the literal string `HEAD` when nothing is
-      // checked out. Recording that verbatim INVENTS a branch: every detached
+      // A detached HEAD answers the literal string `HEAD`, never `refs/heads/…`.
+      // Recording that verbatim INVENTS a branch: every detached
       // run shares a pseudo-branch "HEAD", which is how `actions/checkout`
       // leaves a pull_request build. The trust boundary (`branch ===
       // defaultBranch`) means it is at least never mistaken for trunk, but
       // every PR collapses into one scope — so one PR's timings feed another's
       // baseline, cross-branch regression detection counts them as a single
       // branch, and a consumer grouping runs by branch reads "HEAD".
-      if (br && br !== 'HEAD') branch = br
+      if (br?.startsWith('refs/heads/')) branch = br.slice('refs/heads/'.length)
+    } else {
+      // No commit yet: `rev-parse HEAD` fails, yet HEAD already names the
+      // branch the first commit lands on (`git branch --show-current`).
+      branch = unbornBranch(workspaceRoot)
     }
   } catch {
     // git unavailable / non-repo: both fields stay null.
@@ -129,6 +135,18 @@ export function captureGitContext(
   return { commitSha, branch, dirty }
 }
 
+/** The branch HEAD names, asked of git only after `rev-parse HEAD` failed. */
+function unbornBranch(workspaceRoot: string): string | null {
+  const proc = Bun.spawnSync({
+    cmd: [executablePath('git'), '-C', workspaceRoot, 'symbolic-ref', '--quiet', 'HEAD'],
+    env: gitEnv(),
+    stdout: 'pipe',
+    stderr: 'ignore',
+  })
+  const ref = proc.exitCode === 0 ? new TextDecoder().decode(proc.stdout).trim() : ''
+  return ref.startsWith('refs/heads/') ? ref.slice('refs/heads/'.length) : null
+}
+
 /**
  * `HEAD`'s commit and branch from the `.git` files, or null when anything
  * about the layout is unfamiliar (the caller then spawns git). Handles a
@@ -138,7 +156,7 @@ export function captureGitContext(
  */
 function readHeadDirect(
   workspaceRoot: string,
-): { commitSha: string; branch: string | null } | null {
+): { commitSha: string | null; branch: string | null } | null {
   try {
     const dirs = refDirsOf(workspaceRoot)
     if (dirs === null) return null
@@ -166,7 +184,8 @@ function readHeadDirect(
         }
       }
     }
-    return null
+    // Neither a loose nor a packed ref: the branch has no commit yet.
+    return { commitSha: null, branch }
   } catch {
     return null
   }

package/src/orchestrator/run-failures.ts

@@ -8,7 +8,7 @@ import { isGroupTask, type TaskOutcome } from '../graph/index.js'
 import { decodeOutputLog } from './output-log.js'
 import { PASS_STATUSES } from '../history/index.js'
 import { maskedLine, splitTaskId } from '../util/index.js'
-import { fileLocations, fileMemo, type OutputLocation } from '../report/index.js'
+import { fileLocations, fileMemo, type OutputLocation } from '../ui/index.js'
 
 /** A failed task of a run and what it said. */
 export interface TaskFailure {

package/src/orchestrator/run-records.ts

@@ -38,6 +38,8 @@ export interface RunRecordsInput {
   host: HostContext
   /** Build the telemetry mirror; a run with no sink allocates none. */
   withTelemetry: boolean
+  /** Each task's count of the tasks and groups downstream of it (the scheduler's): the rows' `blocks`. */
+  blocks?: ReadonlyMap<string, number>
   /** The run's remote failures by key, so far (`Cache.traffic`). */
   remoteTraffic?: ReadonlyMap<string, { failures: readonly string[] }>
 }
@@ -124,6 +126,14 @@ export function assembleRunRecords(input: RunRecordsInput): RunRecords {
     if (o.whereCores !== undefined) r.placementCores = o.whereCores
     if (o.whereMemoryBytes !== undefined) r.placementMemoryBytes = o.whereMemoryBytes
     if (o.cpuShare !== undefined) r.cpuShare = o.cpuShare
+    if (o.queuedMs !== undefined) r.queuedMs = o.queuedMs
+    if (o.outputBytes !== undefined) r.outputBytes = o.outputBytes
+    const blocks = input.blocks?.get(o.node.id)
+    if (blocks !== undefined) r.blocks = blocks
+    if (o.flaky !== undefined) {
+      r.flakyPasses = o.flaky.passes
+      r.flakyFailures = o.flaky.failures
+    }
     if (o.wallclockStartNs !== undefined) r.wallclockStartNs = o.wallclockStartNs
     if (o.wallclockEndNs !== undefined) r.wallclockEndNs = o.wallclockEndNs
     if (hit) r.restored = o.restored === true

package/src/orchestrator/run.ts

@@ -39,11 +39,12 @@ import {
   type TaskNode,
   type TaskOutcome,
 } from '../graph/index.js'
+import { graphCounts } from './graph-memo.js'
 import {
   mark,
   stageTimes,
   MAX_TIMEOUT_MS,
-  printTimings,
+  timingLines,
   ulid,
   isLiteralPattern,
   listed,
@@ -53,12 +54,17 @@ import {
   secretMask,
   isFsRefusal,
   isUserError,
-  detectColors,
-  type ColorSupport,
   SecretBroker,
   thrownMessage,
-  type ui,
 } from '../util/index.js'
+import * as ui from '../ui/index.js'
+
+/** The stage table `VX_DEBUG_TIMING=1` asks for, on stderr. */
+function printTimings(): void {
+  const lines = timingLines()
+  if (lines !== undefined) ui.print('err', ui.trace(lines))
+}
+import { detectColors, type ColorSupport } from '../ui/index.js'
 import { keyedProjects } from './keyed-projects.js'
 import { isDefaultBuild } from '../graph/index.js'
 import { commandWriteReach, prepareSandbox } from './sandbox-request.js'
@@ -70,7 +76,6 @@ import { excludedTaint } from './excluded-keys.js'
 import { dependedOn, keyUpstream } from './upstream.js'
 import { createLiveUsage } from './live-usage.js'
 import {
-  blocksCounts,
   busLogger,
   createEventBus,
   createForecast,
@@ -356,6 +361,11 @@ export async function run(options: RunOptions): Promise<RunSummary> {
   const detach = (): void => {
     unsubscribeTerminal()
     unsubscribeWarned()
+    // A run refused or thrown before its tasks (an unknown task, a plugin
+    // stage that threw) never reached the end that takes the live region
+    // down: a load slow enough to show its step left `vx:load running`
+    // on screen, and the CLI's refusal was written onto its last line.
+    terminal?.runDone?.()
     terminal?.settle()
   }
   // A plugin's `output` renders the run from its start; core's renderer
@@ -913,14 +923,39 @@ async function runOnBus(
     const fault = executorFaults(warnOf(log))
     const footers = executors.filter((e) => e.footer !== undefined)
     const placers = executors.filter((e) => e.running !== undefined)
-    // Every row's `blocks`, the live list's and the results': one closure
-    // over the graph, built on the first row that asks.
-    let blocks: ReadonlyMap<string, number> | undefined
-    const blocksNow = (): ReadonlyMap<string, number> => (blocks ??= blocksCounts(nodes))
+    // The scheduler's dependents count, and every row's `blocks` (the live
+    // list's and the results'): one closure over the graph, built on the
+    // first that asks.
+    let counted: ReadonlyMap<string, number> | undefined
+    const blocksNow = (): ReadonlyMap<string, number> =>
+      (counted ??= graphCounts(nodes, hashCache.folds, hashCache.graph))
+    // Every row's `usual` and the forecast's timings: history read once, on
+    // the first row that asks, so a run that executes nothing never reads
+    // it. It was read only a second into a live run, so rows before that,
+    // a short run's and every log's showed none (2026-10-29).
+    let p50s: ReadonlyMap<string, number> | undefined
+    const p50sNow = (): ReadonlyMap<string, number> => {
+      if (p50s !== undefined) return p50s
+      const ids: string[] = []
+      for (const n of nodes.values()) if (!isGroupTask(n)) ids.push(n.id)
+      try {
+        p50s = new LocalHistoryProvider(
+          indexDb(prepared.localCache),
+          undefined,
+          prepared.branch(),
+          taskDefinitions(nodes.values()),
+        ).p50sNow(ids)
+      } catch {
+        // History is observability: an unreadable one knows no task.
+        p50s = new Map()
+      }
+      return p50s
+    }
     // The live rows' `cpu` and `mem`; it looks only once the live list asks.
     const liveUsage = createLiveUsage()
     const runContext = {
       blocks: blocksNow,
+      usual: (id: string) => p50sNow().get(id),
       usage: liveUsage.usage,
       ...(footers.length > 0
         ? { executorRows: () => footers.flatMap((e) => executorFooter(e, fault)) }
@@ -979,17 +1014,7 @@ async function runOnBus(
     // never reads history.
     terminal?.forecast(
       () => createForecast(nodes, new Map(), concurrency, blocksNow()),
-      async () => {
-        const ids: string[] = []
-        for (const n of nodes.values()) if (!isGroupTask(n)) ids.push(n.id)
-        const p50s = await new LocalHistoryProvider(
-          indexDb(prepared.localCache),
-          undefined,
-          prepared.branch(),
-          taskDefinitions(nodes.values()),
-        ).p50sFor(ids)
-        return createForecast(nodes, p50s, concurrency, blocksNow())
-      },
+      async () => createForecast(nodes, p50sNow(), concurrency, blocksNow()),
     )
 
     // Remote-only: kick off background prefetches so remote-GET latency
@@ -1268,10 +1293,12 @@ async function runOnBus(
       }
     }
     let lockBroken: boolean | undefined
+    prepared.localCache.storeHeldBlobSizes()
     const outcomes = await runGraph({
       nodes,
       concurrency,
       restoreConcurrency: options.restoreConcurrency ?? 2 * concurrency,
+      reverseDeps: blocksNow,
       settledOf: (o) => deferredSaves.get(o.node.id),
       ...(hasPooledExecutor(executors) ? { poolOf: poolOfPlacement(placements) } : {}),
       ...(admit !== undefined ? { admit } : {}),
@@ -1280,8 +1307,8 @@ async function runOnBus(
       serverDied,
       onFailFast: () => failFast.abort(),
       signal: stop.signal,
-      onStart: (node, queuedMs) => {
-        log.taskStart?.(node, queuedMs === undefined ? undefined : { waitedMs: queuedMs })
+      onStart: (node) => {
+        log.taskStart?.(node)
       },
       onFinish: (o) => {
         if (cacheOff) o.cacheOff = true
@@ -1380,6 +1407,9 @@ async function runOnBus(
     const hold =
       options.holdPersistent === true &&
       (!stop.signal.aborted || stop.signal.reason === CYCLE_INTERRUPT)
+    // A stop already signalled every server once and waits out its grace:
+    // a SIGTERM here, while a server ran its cleanup, cut it short.
+    if (stop.signal.aborted) await stop.aborting?.catch(() => {})
     const { keepAlive, crashed: crashedPersistent } = await disposeServers({
       registry: persistentRegistry,
       nodes,
@@ -1488,6 +1518,7 @@ async function runOnBus(
         ci: ciContext,
         host: hostContext,
         withTelemetry: telemetry !== undefined,
+        blocks: blocksNow(),
         remoteTraffic: prepared.localCache.traffic.keys,
       })
     const records = recordsOf(list, ok)

package/src/orchestrator/sandbox-request.ts

@@ -446,8 +446,8 @@ export function withheldLinkLine(taskId: string, w: WithheldLink): string {
   return (
     `vx: ${taskId} read \`${w.target}\` through \`${w.link}\`, and its key includes no task of ` +
     `${w.name}, so an edit there would not re-run it. Add a \`dependsOn\` edge that ` +
-    `reaches one (\`^build\` where ${w.name}#build keys its sources, or a \`source\` task: ` +
-    `\`${w.name}#source\`), or grant and key the files yourself (\`allow.read\` plus ` +
+    `reaches one (\`^build\`, where ${w.name}#build keys its sources), or grant and key ` +
+    `the files yourself (\`allow.read\` plus ` +
     `\`inputs.workspaceFiles\`).`
   )
 }

package/src/orchestrator/signals.ts

@@ -14,7 +14,13 @@
 // them to the runner around every spawn.
 
 import { signalExitCode } from '../exec/index.js'
-import { claimExitForSignal, hangupIgnored, killGraceMs, settleWithin } from '../util/index.js'
+import {
+  claimExitForSignal,
+  dieOf,
+  hangupIgnored,
+  killGraceMs,
+  settleWithin,
+} from '../util/index.js'
 import {
   holdGroups,
   killTree,
@@ -154,10 +160,7 @@ export function forwardSignals(args: {
     // and a 130 exit ran the script's next line. The code stays the
     // fallback should the signal not land.
     if (args.handsTerminal !== true) {
-      process.once('exit', () => {
-        process.removeAllListeners(signal)
-        process.kill(process.pid, signal)
-      })
+      process.once('exit', () => dieOf(signal))
     }
     process.exit(signalExitCode(signal))
   }

package/src/orchestrator/task-hash.ts

@@ -519,9 +519,23 @@ function hashableConfig(cfg: TaskConfig): unknown {
   // Keys sorted: moving `cache` above `exec`, or a `define` in another
   // order, missed every key of the task, and a `project` or `graph` plugin
   // writes a config the lock never sorted (2026-10-25).
-  if (cfg.exec?.remote === undefined) return keysSorted(cfg)
-  const { remote: _remote, ...execRest } = cfg.exec
-  return keysSorted({ ...cfg, exec: execRest })
+  const env = cfg.inputs?.env
+  const pass = cfg.exec?.env?.passThrough
+  if (cfg.exec?.remote === undefined && sortedNames(env) && sortedNames(pass))
+    return keysSorted(cfg)
+  const { remote: _remote, ...execRest } = cfg.exec ?? ({} as NonNullable<TaskConfig['exec']>)
+  // Env names are sets: each value is read by its name, so their order
+  // keys nothing (conformance env/declared-order-irrelevant).
+  if (!sortedNames(pass)) execRest.env = { ...execRest.env, passThrough: [...pass!].sort() }
+  const out: TaskConfig = cfg.exec === undefined ? { ...cfg } : { ...cfg, exec: execRest }
+  if (!sortedNames(env)) out.inputs = { ...cfg.inputs!, env: [...env!].sort() }
+  return keysSorted(out)
+}
+
+function sortedNames(names: readonly string[] | undefined): boolean {
+  if (names === undefined) return true
+  for (let i = 1; i < names.length; i++) if (names[i - 1]! > names[i]!) return false
+  return true
 }
 
 /**

package/src/report/events.ts

@@ -45,7 +45,7 @@ export interface RunStartInfo {
  */
 export type RunEvent =
   | { kind: 'run:start'; info: RunStartInfo }
-  | { kind: 'task:start'; node: TaskNode; waitedMs?: number }
+  | { kind: 'task:start'; node: TaskNode }
   | { kind: 'task:stdout'; node: TaskNode; chunk: string }
   | { kind: 'task:stderr'; node: TaskNode; chunk: string }
   | { kind: 'task:complete'; node: TaskNode; outcome: TaskOutcome }
@@ -139,12 +139,7 @@ export function busLogger(bus: EventBus): Logger {
     taskStderr: (node, chunk) => bus.emit({ kind: 'task:stderr', node, chunk }),
     taskComplete: (node, outcome) => bus.emit({ kind: 'task:complete', node, outcome }),
     runStart: (info) => bus.emit({ kind: 'run:start', info }),
-    taskStart: (node, info) =>
-      bus.emit(
-        info?.waitedMs === undefined
-          ? { kind: 'task:start', node }
-          : { kind: 'task:start', node, waitedMs: info.waitedMs },
-      ),
+    taskStart: (node) => bus.emit({ kind: 'task:start', node }),
     runEnd: () => {
       if (ended) return
       ended = true
@@ -179,10 +174,7 @@ export function terminalSubscriber(sink: Logger): RunEventSubscriber {
         sink.runStart?.(event.info)
         return
       case 'task:start':
-        sink.taskStart?.(
-          event.node,
-          event.waitedMs === undefined ? undefined : { waitedMs: event.waitedMs },
-        )
+        sink.taskStart?.(event.node)
         return
       case 'task:stdout':
         sink.taskStdout(event.node, event.chunk)