@vzn/vx 0.0.651 → 0.0.652

package/src/graph/definition.ts

@@ -15,18 +15,31 @@ const memo = new WeakMap<TaskNode, string | undefined>()
 export function taskDefinition(node: TaskNode): string | undefined {
   if (memo.has(node)) return memo.get(node)
   const exec = node.config.exec
+  const define = exec?.env?.define
   const def =
     exec?.command === undefined
       ? undefined
       : xxh3hex(
-          `${node.id}\0${exec.command}\0${JSON.stringify(
-            Object.entries(exec.env?.define ?? {}).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)),
-          )}`,
+          `${node.id}\0${exec.command}\0${
+            // `[]` is what the stringify gives for no values: most tasks
+            // have none, and stringifying it for each was ~9 ms of an
+            // 8,002-hit warm run.
+            define === undefined || isEmpty(define)
+              ? '[]'
+              : JSON.stringify(
+                  Object.entries(define).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)),
+                )
+          }`,
         )
   memo.set(node, def)
   return def
 }
 
+function isEmpty(o: object): boolean {
+  for (const _ in o) return false
+  return true
+}
+
 /** Each task's definition (`taskDefinition`) by id, groups left out: what a history reader matches rows to. */
 export function taskDefinitions(nodes: Iterable<TaskNode>): Map<string, string> {
   const out = new Map<string, string>()

package/src/graph/scheduler.ts

@@ -186,7 +186,7 @@ export interface TaskOutcome {
   serverExit?: number
   /**
    * The input that changed while the command ran, failing the task under
-   * `inputStability.severity: 'error'` (workspace-relative; '' when vx
+   * `inputs.stability.severity: 'error'` (workspace-relative; '' when vx
    * could not name it). The exit is vx's 1; the label reads this instead.
    */
   inputMoved?: string
@@ -231,6 +231,8 @@ export interface TaskOutcome {
   attempts?: number
   /** The attempts that failed and were run again, in order: when each ended (epoch ms) and how. */
   failedAttempts?: readonly { endedAt: number; exitCode: number; timedOut?: true }[]
+  /** Each of `failedAttempts`' output, as `failedOutput` encodes it: what `vx last --log` shows. */
+  attemptOutputs?: readonly string[]
   /**
    * Set when this run proved the task flaky: its key failed after it had
    * passed (this run's included) or it passed only on a retry. Its row carries it.

package/src/graph/task-graph.ts

@@ -294,7 +294,7 @@ export interface BuildGraphOptions {
    */
   undeclaredDeps?: (taskId: string, name: string) => void
   /**
-   * The workspace root, where `cache.outputs.workspaceFiles` is anchored.
+   * The workspace root, where `outputs.workspaceFiles` is anchored.
    * Given, a root-anchored output is also compared with every project's
    * `files` outputs (item 1088); absent (a graph built for a unit row), only
    * with other root-anchored ones.
@@ -1274,7 +1274,7 @@ function detectOutputCollisions(
   const byProject = new Map<string, TaskNode[]>()
   const wsDeclarers: TaskNode[] = []
   for (const n of nodes.values()) {
-    const outs = n.config.cache?.outputs
+    const outs = n.config.outputs
     if ((outs?.files?.length ?? 0) > 0) {
       const bucket = byProject.get(n.projectName)
       if (bucket) bucket.push(n)
@@ -1290,9 +1290,9 @@ function detectOutputCollisions(
   const positiveOf = (globs: readonly string[] | undefined): readonly string[] | undefined =>
     globs === undefined ? undefined : splitNegations(globs).positive
   const filesOf = (n: TaskNode): readonly string[] | undefined =>
-    positiveOf(n.config.cache?.outputs.files)
+    positiveOf(n.config.outputs?.files)
   const wsFilesOf = (n: TaskNode): readonly string[] | undefined =>
-    positiveOf(n.config.cache?.outputs.workspaceFiles)
+    positiveOf(n.config.outputs?.workspaceFiles)
   for (const bucket of byProject.values()) {
     // Most projects hold one task with outputs, and a call per project
     // cost the cold build a measured 0.4 ms at 1,000 projects.
@@ -1346,7 +1346,7 @@ function detectOutputCollisions(
  * captures, so the pair cannot collide there.
  */
 function takenBackOf(n: TaskNode, field: 'files' | 'workspaceFiles'): string[] {
-  return splitNegations(n.config.cache?.outputs[field] ?? []).negative
+  return splitNegations(n.config.outputs?.[field] ?? []).negative
 }
 
 /**
@@ -1374,9 +1374,9 @@ function collideAcross(
       if (!outputsOverlap(ga, gb) || outputTakenBack(gb, wsBack) || outputTakenBack(ga, filesBack))
         continue
       const head =
-        `${ws.id} declares the output ${JSON.stringify(ga)} in cache.outputs.workspaceFiles, ` +
+        `${ws.id} declares the output ${JSON.stringify(ga)} in outputs.workspaceFiles, ` +
         `inside ${files.id}'s ${JSON.stringify(gb.slice(rel === '' ? 0 : rel.length + 1))} in ` +
-        `cache.outputs.files — vx cleans a task's declared outputs before it runs and before a ` +
+        `outputs.files — vx cleans a task's declared outputs before it runs and before a ` +
         `cache-hit restore, so whichever of these runs second DELETES the other's output`
       if (exclusive && (reaches(files.id, ws.id) || reaches(ws.id, files.id))) {
         throw new UserError(`${head}. ${EXCLUSIVE_OUTPUTS_FIX}`, 'VX_E_OUTPUT_OVERLAP')
@@ -1400,7 +1400,7 @@ function collideAcross(
         const outside = wsGlobs[own.indexOf(null)]!
         throw new UserError(
           `${head}. ${ws.id} depends on ${files.id}, but adding to its output needs every ` +
-            `cache.outputs.workspaceFiles entry inside ${rel === '' ? 'the workspace root' : rel}, ` +
+            `outputs.workspaceFiles entry inside ${rel === '' ? 'the workspace root' : rel}, ` +
             `and ${JSON.stringify(outside)} is not. Give each task its own output path.`,
           'VX_E_OUTPUT_OVERLAP',
         )
@@ -1640,7 +1640,7 @@ function collide(
       const head =
         `${a.id} and ${b.id} both declare the output ${JSON.stringify(ga)}` +
         (ga === gb ? '' : ` / ${JSON.stringify(gb)}`) +
-        ` in cache.outputs.${field} — vx cleans a task's declared outputs before it runs and ` +
+        ` in outputs.${field} — vx cleans a task's declared outputs before it runs and ` +
         `before a cache-hit restore, so whichever of these runs second DELETES the other's ` +
         `output`
       // An overlap WITH an edge is the addition shape (item 588): the
@@ -1652,7 +1652,7 @@ function collide(
       const [up, down] = reaches(b.id, a.id) ? [a, b] : reaches(a.id, b.id) ? [b, a] : []
       const parts = {
         headline: `${a.id} and ${b.id} both write ${ga === gb ? ga : `${ga} / ${gb}`}`,
-        ...(field === 'files' ? {} : { what: ['in cache.outputs.workspaceFiles'] }),
+        ...(field === 'files' ? {} : { what: ['in outputs.workspaceFiles'] }),
         why: "vx clears a task's outputs before it runs, so one deletes the other's",
       }
       if (up !== undefined && exclusive)
@@ -1665,9 +1665,8 @@ function collide(
         )
       if (up !== undefined && down !== undefined) {
         const downGlobs = splitNegations(
-          (field === 'files'
-            ? down.config.cache?.outputs.files
-            : down.config.cache?.outputs.workspaceFiles) ?? [],
+          (field === 'files' ? down.config.outputs?.files : down.config.outputs?.workspaceFiles) ??
+            [],
         ).positive
         ;(down.addsToOutputsOf ??= []).push(up.id)
         ;(up.outputsAddedToBy ??= []).push(...(downGlobs ?? []))
@@ -1706,13 +1705,13 @@ export function outputTakenBack(output: string, negatives: readonly string[]): b
  * and its key read nothing (hunt 8). Always refused, whatever the rules.
  */
 function refuseSelfClean(node: TaskNode): void {
-  const cache = node.config.cache
+  const declaredOutputs = node.config.outputs
   const declared = node.config.inputs
-  if (cache === undefined || declared === undefined) return
+  if (declaredOutputs === undefined || declared === undefined) return
   for (const field of ['files', 'workspaceFiles'] as const) {
-    if (!coversAny(declared[field], cache.outputs[field])) continue
+    if (!coversAny(declared[field], declaredOutputs[field])) continue
     const inputs = splitNegations(declared[field] ?? [])
-    const out = splitNegations(cache.outputs[field] ?? [])
+    const out = splitNegations(declaredOutputs[field] ?? [])
     const outputs = out.positive
     if (outputs.length === 0) continue
     const roots = outputs.map((g) => rootless(staticPrefix(g)))
@@ -1823,11 +1822,11 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     return list
   }
   for (const n of nodes.values()) {
-    const cache = n.config.cache
+    const declaredOutputs = n.config.outputs
     const inputs = n.config.inputs
     if (inputs === undefined) continue
-    const outFiles = positives(cache?.outputs.files ?? [])
-    const outWs = positives(cache?.outputs.workspaceFiles ?? [])
+    const outFiles = positives(declaredOutputs?.files ?? [])
+    const outWs = positives(declaredOutputs?.workspaceFiles ?? [])
     if (outFiles.length > 0) {
       const anchor = workspaceRoot === undefined ? undefined : relPosix(workspaceRoot, n.projectDir)
       bucket(n.projectName).push({ node: n, globs: outFiles, reads: false, anchor })
@@ -1895,7 +1894,7 @@ function readsRootedOutputs(
   if (workspaceRoot !== undefined) {
     for (const node of filesWriters) {
       const rel = relPosix(workspaceRoot, node.projectDir)
-      const globs = positives(node.config.cache!.outputs.files).map((g) =>
+      const globs = positives(node.config.outputs!.files).map((g) =>
         rel === '' ? g : `${rel}/${g}`,
       )
       rooted.push({ node, globs, reads: false, rel })
@@ -2025,14 +2024,16 @@ function takenBack(
   let tb = memo.bySide.get(reader)
   if (tb === undefined) {
     const inputs = reader.node.config.inputs!
-    const cache = reader.node.config.cache
+    const declaredOutputs = reader.node.config.outputs
     // A reader rebased to the root (X-135) speaks in its project's terms.
     const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
     // What the reader's key never reads: its `!` entries and its own outputs.
     const list = [
       ...splitNegations(field === 'files' ? inputs.files : (inputs.workspaceFiles ?? [])).negative,
       ...splitNegations(
-        field === 'files' ? (cache?.outputs.files ?? []) : (cache?.outputs.workspaceFiles ?? []),
+        field === 'files'
+          ? (declaredOutputs?.files ?? [])
+          : (declaredOutputs?.workspaceFiles ?? []),
       ).positive,
     ].map((g) => at + g)
     const key = list.join('\0')

package/src/history/failure-mode.ts

@@ -30,7 +30,7 @@ export type FailureMode = 'stable' | 'flaky-recoverable' | 'flaky-fatal'
  * `status`, `cache_hit`, `cached` columns) with how often it failed, how often it
  * passed — an executed success or a cache hit, which replays a success —
  * and how often it failed AFTER its first pass (`relapses`). A task with
- * no cache block keys on its config alone and runs every time, so its key
+ * no `cache: true` keys on its config alone and runs every time, so its key
  * says nothing about its inputs: no reader counts it, as no run's row
  * calls it flaky. Nor is a row that names a `blocked_by`: it ran behind a
  * failure (`--continue=always`), on bytes its key never named, so its
@@ -198,6 +198,29 @@ export function detectFlaky(db: Database, candidates: readonly FlakyCandidate[])
   return out
 }
 
+/**
+ * Whether a task that just failed on `hash` is known to be flaky: this key
+ * passed before (the failure itself is the flake), or the retained history
+ * holds a key of the task that failed after it passed, or a pass that took
+ * a retry. Asked only after a failure, so a green run never reads it.
+ */
+export function knownFlaky(db: Database, project: string, task: string, hash: string): boolean {
+  const passed = db
+    .query(
+      `SELECT 1 FROM ${OUTCOMES} WHERE hash = ? AND project = ? AND task = ?
+       AND (status = 'success' OR status IN ${HIT_STATUSES}) LIMIT 1`,
+    )
+    .get(hash, project, task)
+  if (passed !== null) return true
+  const flaked = db
+    .query(
+      `SELECT 1 FROM (${keyOutcomesSql(OUTCOMES, ' AND project = ? AND task = ?')})
+       WHERE relapses > 0 OR retried_failures > 0 LIMIT 1`,
+    )
+    .get(project, task)
+  return flaked !== null
+}
+
 /** One task the recorded history shows failing on a key that had passed. */
 export interface FlakyTask {
   /** `project#task`. */

package/src/history/index.ts

@@ -16,6 +16,7 @@ export {
 } from './history.js'
 export {
   detectFlaky,
+  knownFlaky,
   type FailureMode,
   type FlakyCandidate,
   type FlakyFinding,

package/src/history/metrics.ts

@@ -39,7 +39,7 @@ export interface RunSummaryRow {
   cacheHit: boolean | null
   /** On a hit: true when outputs were restored, false when up-to-date (v31); null otherwise. */
   restored: boolean | null
-  /** Whether the task declared a `cache` block; null on rows older than the column. */
+  /** Whether the task declared `cache: true`; null on rows older than the column. */
   cached: boolean | null
   hash: string
   cpuMs: number | null
@@ -382,7 +382,7 @@ export interface WhyDidThisRerun {
     cacheHit: boolean | null
     /** On a hit: outputs restored (true) or up-to-date (false); null otherwise. */
     restored: boolean | null
-    /** Whether the task declared a `cache` block; null on rows older than the column. */
+    /** Whether the task declared `cache: true`; null on rows older than the column. */
     cached: boolean | null
     startedAt: number
   }
@@ -614,9 +614,9 @@ export function whyDidThisRerun(db: Database, runId: string, taskId: string): Wh
           // one's is new each run, so every dependent misses: "folded by
           // dependents" read as if they could hit.
           this_.keylessBy === null
-          ? 'this task declares no `cache` block — it runs on every invocation; its key is folded by dependents only'
+          ? 'this task declares no `cache: true` — it runs on every invocation; its key is folded by dependents only'
           : this_.keylessBy === taskId
-            ? 'this task declares no `cache` block — it runs on every invocation; it declares no `inputs` either, so each run derives a new key and every task that depends on it misses; declare its `inputs`'
+            ? 'this task declares no `cache: true` — it runs on every invocation; it declares no `inputs` either, so each run derives a new key and every task that depends on it misses; declare its `inputs`'
             : `this task declares no \`cache\` block — it runs on every invocation; its key includes ${this_.keylessBy}, which declares no \`inputs\`, so each run derives a new key and every task that depends on it misses; declare inputs on ${this_.keylessBy}`
         : this_.keylessBy !== null
           ? keylessNote(taskId, this_.keylessBy)
@@ -889,7 +889,7 @@ export function cacheKeyDiff(db: Database, runId: string, taskId: string): Cache
         this_.cached === 0
           ? // The verdict already says the task is uncached; this line says
             // why no input can be named.
-            'with no `cache` block it saves no entry, so no input fingerprints are kept to say which of its `inputs` moved its key; with no `inputs`, every run gives it a new key'
+            'without `cache: true` it saves no entry, so no input fingerprints are kept to say which of its `inputs` moved its key; with no `inputs`, every run gives it a new key'
           : unsaved !== null
             ? `cache key changed but input fingerprints are unavailable — ${unsaved} and saved no entry; only the key change is known`
             : 'cache key changed but input fingerprints are unavailable — the entry was pruned (or the row predates the `cached` column); only the key change is known',

package/src/index.ts

@@ -41,9 +41,10 @@ export type {
   TaskConfig,
   ExecConfig,
   ExecEnv,
-  CacheConfig,
   InputsConfig,
-  CacheOutputs,
+  TaskOutputs,
+  WorkspaceInputs,
+  WorkspaceOutputs,
   InputStability,
   SandboxConfig,
   SandboxGrants,
@@ -245,6 +246,7 @@ export type {
   ServerSpec,
   TaskExecutor,
   TaskPlacement,
+  WorkerAdvice,
 } from './exec/index.js'
 
 // Telemetry — THE canonical, versioned data-export contract every exporter

package/src/orchestrator/admission.ts

@@ -186,7 +186,7 @@ export function admitTasks(
     const cacheable =
       !isGroupTask(node) &&
       node.config.exec?.persistent === undefined &&
-      node.config.cache !== undefined &&
+      node.config.cache === true &&
       canRead &&
       canWrite
     // A restore-tier task (confirmed local hit, may run before its deps)

package/src/orchestrator/command-windows.ts

@@ -1,5 +1,5 @@
 // When each command of the run ran and where it may write, so
-// `inputStability.strategy: 'mutable'` can tell a task's own identical
+// `inputs.stability.strategy: 'mutable'` can tell a task's own identical
 // rewrite from another task's write and restore (STATUS item 28): a file
 // whose bytes match the key after a write is the task's own only if no
 // other command that may write it ran between the describe and that write.

package/src/orchestrator/deferred-outputs.ts

@@ -115,7 +115,7 @@ export class DeferredOutputs {
     // Project outputs only: a task declaring `outputs.workspaceFiles` is
     // never deferred (`deferralEligibility` forces it eager), so nothing
     // workspace-anchored can reach this path.
-    const outputs = producer.config.cache?.outputs.files ?? []
+    const outputs = producer.config.outputs?.files ?? []
     const nestedProjectDirs = this.args.nestedDirsByProject.get(producer.projectName) ?? []
     const cleanArgs = {
       projectDir: producer.projectDir,

package/src/orchestrator/download-policy.ts

@@ -44,14 +44,12 @@ export function deferralEligibility(nodes: Map<string, TaskNode>): Map<string, s
     if (list) list.push({ taskId: n.id, prefixes, via })
     else readersByProject.set(n.projectName, [{ taskId: n.id, prefixes, via }])
   }
-  // A task with no `cache` block keys on its inputs, and a cached task that
+  // A task without `cache: true` keys on its inputs, and a cached task that
   // depends on it folds that key: deferring a producer there moved both
   // keys with the transfer flag. Only such a task is a reader — one nothing
   // cached folds keys nothing that lasts.
   const folded = new Set<string>()
-  const stack = [...nodes.values()]
-    .filter((n) => n.config.cache !== undefined)
-    .flatMap((n) => n.deps)
+  const stack = [...nodes.values()].filter((n) => n.config.cache === true).flatMap((n) => n.deps)
   for (let id = stack.pop(); id !== undefined; id = stack.pop()) {
     if (folded.has(id)) continue
     folded.add(id)
@@ -63,7 +61,7 @@ export function deferralEligibility(nodes: Map<string, TaskNode>): Map<string, s
     const inputs = n.config.inputs
     // A task with no inputs has no key to read; an uncached one with inputs
     // is read only for the cached tasks that fold its key.
-    if (inputs === undefined || (n.config.cache === undefined && !folded.has(n.id))) continue
+    if (inputs === undefined || (n.config.cache !== true && !folded.has(n.id))) continue
     if ((inputs?.workspaceFiles?.length ?? 0) > 0) workspaceReader ??= n.id
     // A `runtime` input is a SHELL COMMAND whose reads are unknowable —
     // the same reason vx refuses to infer inputs by tracing. It can `cat` a
@@ -86,11 +84,11 @@ export function deferralEligibility(nodes: Map<string, TaskNode>): Map<string, s
   }
 
   for (const n of nodes.values()) {
-    const outputs = n.config.cache?.outputs
+    const outputs = n.config.outputs
     if ((outputs?.workspaceFiles?.length ?? 0) > 0) {
       ineligible.set(
         n.id,
-        'declares cache.outputs.workspaceFiles — root-anchored outputs can land where any project-relative input reads',
+        'declares outputs.workspaceFiles — root-anchored outputs can land where any project-relative input reads',
       )
       continue
     }

package/src/orchestrator/excluded-keys.ts

@@ -117,7 +117,7 @@ export function excludedTaint(nodes: ReadonlyMap<string, TaskNode>): {
   let unsaved = 0
   for (const id of reached) {
     const cfg = nodes.get(id)!.config
-    if (cfg.cache !== undefined && cfg.exec?.persistent === undefined) unsaved++
+    if (cfg.cache === true && cfg.exec?.persistent === undefined) unsaved++
   }
   return { seeds, unsaved }
 }

package/src/orchestrator/execute-task.ts

@@ -1,5 +1,5 @@
 import path from 'node:path'
-import type { ExecConfig, TaskConfig, CacheConfig, InputStability } from '../config.js'
+import type { ExecConfig, TaskConfig, InputsConfig, InputStability } from '../config.js'
 import {
   ArtifactVanishedError,
   type CacheEntry,
@@ -58,6 +58,7 @@ import { executorLabel, nameExecutorFailure } from './plugin-host.js'
 import type { CommandWindows } from './command-windows.js'
 import {
   commandWriteReach,
+  dependencyReads,
   mayWriteFingerprint,
   type Placeholder,
   reachedWithheld,
@@ -183,17 +184,23 @@ export interface ExecuteArgs {
    * byte-identical with and without it.
    */
   retries?: number
+  /**
+   * Whether the run history knows the task as flaky (`knownFlaky`): a keyed
+   * task with no `retries` of its own or of the run that fails gets ONE more
+   * attempt when it does. Decided at run time, so never in the key.
+   */
+  knownFlaky?: (node: TaskNode, hash: string) => boolean
   /**
    * `run.timeout` (ms), already resolved from flag, variable and
    * workspace. Per-task `exec.timeout` wins. Never hashed.
    */
   timeout?: number
   /**
-   * The run's `inputStability` layers around the task's own: `run` from
+   * The run's `inputs.stability` layers around the task's own: `run` from
    * the env vars (above the task), `workspace` from `.vx/workspace` (below).
    */
   inputStability?: { run: InputStability; workspace?: InputStability }
-  /** `cache.outputs.clean` for tasks without their own: `.vx/workspace`. */
+  /** `outputs.clean` for tasks without their own: `.vx/workspace`. */
   cleanOutputs?: boolean
   /** Per-run memo for `git ls-files` (one entry per project dir). */
   gitFilesCache?: GitFilesCache
@@ -236,6 +243,11 @@ export interface ExecuteArgs {
    * granted a linked workspace package only when it is in this set.
    */
   keyedProjects: (node: TaskNode) => ReadonlySet<string>
+  /**
+   * The run's lookup of the tasks whose outputs a sandboxed task may read
+   * (keyed-projects.ts `readableDeps`). Absent: none.
+   */
+  readableDeps?: (node: TaskNode) => readonly TaskNode[]
   /**
    * Run-scoped list the miss path appends its output-directory snapshot
    * request to, taken at run end (run.ts) instead of right after the save:
@@ -345,7 +357,7 @@ function readsCache(args: ExecuteArgs): boolean {
   const policy = args.cachePolicy ?? FULL_CACHE_POLICY
   return (
     args.remoteOnly !== true &&
-    args.node.config.cache !== undefined &&
+    args.node.config.cache === true &&
     (policy.localRead || policy.remoteRead)
   )
 }
@@ -397,16 +409,16 @@ async function restoreOrMiss(
 
 /**
  * What a write to an input during the command means, each field highest
- * first: the env var (`layers.run`), the task's `cache.inputStability`,
+ * first: the env var (`layers.run`), the task's `inputs.stability`,
  * the workspace's, then `'immutable'` and `'warn'` (2026-10-12), so
  * by default any such write withholds the save, on CI too, since a
  * concurrent task can change an input and put it back.
  */
 function inputStabilityOf(
-  cache: CacheConfig | undefined,
+  inputs: InputsConfig | undefined,
   layers: ExecuteArgs['inputStability'],
 ): Required<InputStability> {
-  const task = cache?.inputStability
+  const task = inputs?.stability
   return {
     strategy: layers?.run.strategy ?? task?.strategy ?? layers?.workspace?.strategy ?? 'immutable',
     severity: layers?.run.severity ?? task?.severity ?? layers?.workspace?.severity ?? 'warn',
@@ -518,9 +530,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const { node, upstream, cache, log } = args
   const cfg: TaskConfig = node.config
   const step = cfg.exec as ExecConfig // dispatcher guarantees exec is present
-  const cacheCfg: CacheConfig | undefined = cfg.cache
+  const cfgOut = cfg.outputs
   const policy = args.cachePolicy ?? FULL_CACHE_POLICY
-  const cfgCacheable = cacheCfg !== undefined
+  const cfgCacheable = cfg.cache === true
   // We may READ when at least one read axis is on (the cache layer
   // refines local vs remote), and WRITE when at least one write axis is
   // on. Output management (clean before exec) keys off writes — so
@@ -571,8 +583,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const deferralRequested = args.download === 'deferred'
   const capture: CaptureConfig = { stdout: false, stderr: false }
 
-  const outputs = cacheCfg?.outputs.files ?? []
-  const wsOutputs = cacheCfg?.outputs.workspaceFiles ?? []
+  const outputs = cfgOut?.files ?? []
+  const wsOutputs = cfgOut?.workspaceFiles ?? []
   const effectiveForwardArgs = node.requested ? (args.forwardArgs ?? []) : []
   // Per-task `exec.timeout` beats `run.timeout` (flag, variable,
   // workspace; resolved into `args.timeout` by run.ts).
@@ -735,12 +747,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const additive = (node.addsToOutputsOf?.length ?? 0) > 0
   let stampedBefore: ReadonlyMap<string, OutputStamp> | undefined
   let wsStampedBefore: ReadonlyMap<string, OutputStamp> | undefined
-  // `cache.outputs.clean: false` leaves the outputs to the first attempt's
+  // `outputs.clean: false` leaves the outputs to the first attempt's
   // command, and the save stores whatever they hold after it, a leftover
   // included: the user opted out of the clean-tree guarantee
   // (2026-10-15). A retry still starts clean. An additive task never cleans
   // by glob anyway.
-  const keepOutputs = !additive && (cacheCfg?.outputs.clean ?? args.cleanOutputs ?? true) === false
+  const keepOutputs = !additive && (cfgOut?.clean ?? args.cleanOutputs ?? true) === false
 
   // Cache lookup. On hit, time the user-perceived restore op
   // (clean+restore+log-replay) — that's what the framed-block footer
@@ -889,7 +901,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // Cache miss path (or caching disabled), up to `1 + retries` attempts.
   // Explicit config wins over the run-level `--retries` default, including
   // an explicit `retries: 0`.
-  const maxAttempts = 1 + (step.retries ?? args.retries ?? 0)
+  const retriesSet = step.retries !== undefined || args.retries !== undefined
+  let maxAttempts = 1 + (step.retries ?? args.retries ?? 0)
   let attempt = 0
   let result: ExecuteResult
   let effectiveExitCode: number
@@ -1173,6 +1186,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const storeMask = secrets ?? undefined
   const storedOutput = (): string => encodeOutputLog(output?.chunks() ?? [], storeMask)
   const failedAttempts: { endedAt: number; exitCode: number; timedOut?: true }[] = []
+  // Each failed attempt's output, beside `failedAttempts`: kept for `vx last --log`.
+  const attemptOutputs: string[] = []
   // The sampling of the attempt's process tree, stopped once it settles.
   let untrack: (() => TreeLoad | undefined) | undefined
   // What the last attempt's samples saw, for the run history.
@@ -1211,6 +1226,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     if (a.withdrawn) {
       attempt--
       failedAttempts.pop()
+      attemptOutputs.pop()
       break
     }
     forgetUndeclaredWrites(args, writeReach)
@@ -1252,12 +1268,27 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       }
     }
 
+    // A known flake gets the one retry its config did not ask for; a
+    // timeout always fails, and a task whose key names nothing (no cache
+    // block, or keyed on a keyless upstream) has no record to know it by.
+    if (
+      effectiveExitCode !== 0 &&
+      attempt === 1 &&
+      !retriesSet &&
+      result.timedOut !== true &&
+      cfgCacheable &&
+      !keyless &&
+      args.failFast?.aborted !== true &&
+      args.knownFlaky?.(node, hash) === true
+    )
+      maxAttempts = 2
     if (effectiveExitCode === 0 || attempt >= maxAttempts || args.failFast?.aborted === true) break
     failedAttempts.push({
       endedAt: Date.now(),
       exitCode: effectiveExitCode,
       ...(result.timedOut === true ? { timedOut: true as const } : {}),
     })
+    attemptOutputs.push(output === undefined ? '' : failedOutputLog(output, true, storeMask))
     log.taskStderr(
       node,
       `${midLine ? '\n' : ''}vx: retrying ${node.id} (attempt ${attempt + 1}/${maxAttempts}) after ${result.timedOut === true ? 'a timeout' : `exit ${effectiveExitCode}`}\n`,
@@ -1285,6 +1316,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     flushMasked = () => masked?.end()
     const base: ExecuteRequest = {
       taskId: node.id,
+      ...(attempt > 1 ? { attempt } : {}),
       workspaceRoot: args.workspaceRoot,
       command: step.command,
       forwardArgs: effectiveForwardArgs,
@@ -1336,6 +1368,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       cfgCacheable ? args.keyedProjects(node) : undefined,
       args.nestedProjectDirs,
       args.cacheDir,
+      await dependencyReads(args.readableDeps?.(node) ?? [], args.workspaceRoot),
     )
     placeholders = sb.placeholders
     withheld = sb.withheld
@@ -1344,7 +1377,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
 
   const wallclockEndNs = process.hrtime.bigint() - args.runStartHrTimeNs
 
-  const stability = inputStabilityOf(args.node.config.cache, args.inputStability)
+  const stability = inputStabilityOf(args.node.config.inputs, args.inputStability)
   let movedFails: string | undefined
   let own: Awaited<ReturnType<typeof ownOutputs>>
   let saved = false
@@ -1540,11 +1573,11 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     const hint =
       moved === null || rewroteBy !== undefined
         ? ''
-        : '; if the task writes it, declare it in cache.outputs'
+        : '; if the task writes it, declare it in outputs'
     if (stability.severity === 'error') {
       warnOf(log)(
         `[vx] ${node.id}: ${what} — the result is not saved, ` +
-          `and inputStability.severity is 'error', so the task fails${hint}`,
+          `and inputs.stability.severity is 'error', so the task fails${hint}`,
       )
       movedFails = moved === null ? '' : printable(relPosix(args.workspaceRoot, moved))
     } else {
@@ -1577,7 +1610,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     durationMs: spentMs,
     hash,
     ...(attempt > 1 ? { attempts: attempt } : {}),
-    ...(failedAttempts.length > 0 ? { failedAttempts } : {}),
+    ...(failedAttempts.length > 0 ? { failedAttempts, attemptOutputs } : {}),
     ...(described !== undefined
       ? { inputFiles: captured.reduce((n, c) => (c.kind === 'file' ? n + 1 : n), 0) }
       : {}),

package/src/orchestrator/hit-restore.ts

@@ -9,7 +9,6 @@
 // 2026-09-10 as pure code motion, the mirror of miss-save.ts.
 
 import path from 'node:path'
-import type { CacheConfig } from '../config.js'
 import {
   type CacheEntry,
   cleanOutputPaths,
@@ -58,9 +57,9 @@ export interface RestoreHitArgs {
 export async function restoreHit(given: RestoreHitArgs): Promise<TaskOutcome> {
   const { args, hash } = given
   const { node } = args
-  const cacheCfg: CacheConfig | undefined = node.config.cache
-  const outputs = cacheCfg?.outputs.files ?? []
-  const wsOutputs = cacheCfg?.outputs.workspaceFiles ?? []
+  const cfgOut = node.config.outputs
+  const outputs = cfgOut?.files ?? []
+  const wsOutputs = cfgOut?.workspaceFiles ?? []
   const anyOutputs = outputs.length > 0 || wsOutputs.length > 0
   // A layer that handed no rows: one SELECT, read by both paths below.
   const restore =
@@ -399,8 +398,8 @@ export async function restoreHit(given: RestoreHitArgs): Promise<TaskOutcome> {
 export function currentHit(restore: RestoreHitArgs): (() => TaskOutcome) | undefined {
   const { args, hash, hit } = restore
   const { node } = args
-  const outputs = node.config.cache?.outputs.files ?? []
-  if ((node.config.cache?.outputs.workspaceFiles?.length ?? 0) > 0) return undefined
+  const outputs = node.config.outputs?.files ?? []
+  if ((node.config.outputs?.workspaceFiles?.length ?? 0) > 0) return undefined
   if (outputs.length > 0) {
     const dirPrefixes = dirPrefixesOf(outputs)
     if (dirPrefixes === null || args.cache.outputDirsCurrent === undefined) return undefined