@vzn/vx 0.0.651 → 0.0.653

package/src/cache/cache.ts

@@ -45,13 +45,31 @@ import {
   readdirSync,
   readFileSync,
   renameSync,
+  type Stats,
   statSync,
   utimesSync,
   writeFileSync,
 } from 'node:fs'
-import { chmod, lstat, mkdir, readdir, rm, stat, unlink, utimes, writeFile } from 'node:fs/promises'
+import {
+  chmod,
+  mkdir,
+  readdir,
+  rename,
+  rm,
+  stat,
+  unlink,
+  utimes,
+  writeFile,
+} from 'node:fs/promises'
 import path from 'node:path'
-import { createArtifactTables, createTables, inHashes, lazyStatement } from './schema.js'
+import {
+  createArtifactTables,
+  createTables,
+  inHashes,
+  lazyStatement,
+  RUNS_VIEW,
+  SQLITE_FCNTL_PERSIST_WAL,
+} from './schema.js'
 import {
   UserError,
   DOT_VX_GITIGNORE,
@@ -61,6 +79,8 @@ import {
   isFsRefusal,
   isOutOfFds,
   OUT_OF_FDS_HINT,
+  OWN_DIR_HINT,
+  refuseForeignCacheDir,
   restorableOutput,
   relPosix,
   span,
@@ -71,6 +91,7 @@ import {
   ArchiveSecurityError,
   type ArtifactPlan,
   type ExecUsage,
+  copyStaging,
   extractArtifactStream,
   scanArtifact,
   scanTarBytes,
@@ -79,9 +100,10 @@ import {
   planArtifact,
   planOfTree,
   sealTree,
+  stagesInto,
   writeTree,
 } from './archive.js'
-import { readUmask, restoredMode } from './umask.js'
+import { modeMatches, readUmask, restoredMode } from './umask.js'
 import {
   ArtifactVanishedError,
   type CacheEntry,
@@ -120,6 +142,7 @@ import { CACHE_VERSION, foldKey } from './key-fold.js'
 import { type FoldMemo, IndexFoldMemo } from './fold-memo.js'
 import { IndexRemoteHits, type RemoteHits } from './remote-hits.js'
 import { behindLink } from './linked-inputs.js'
+import { WalCheckpointer } from './checkpointer.js'
 
 /**
  * An artifact or temp file without an `entries` row is never reaped
@@ -132,6 +155,10 @@ import { behindLink } from './linked-inputs.js'
  */
 // About 1.3 ms of inserts per turn: a task's exit waits at most that.
 const HELD_SLICE = 250
+/** SQLite's own default, back on a connection whose checkpoint thread failed. */
+const WAL_AUTOCHECKPOINT = 1000
+/** Asks whether an open database file is still the one at its name (`attachStore`). */
+const SQLITE_FCNTL_HAS_MOVED = 20
 
 const ORPHAN_GRACE_MS = 60 * 60 * 1000
 
@@ -167,6 +194,7 @@ const VX_CACHE_NAMES = new Set([
   'cache.db-wal',
   'cache.db-shm',
   'cache.db-journal',
+  'cache.lock',
   // Every record vx keeps lives in cache.db, and the config bundle always
   // in `.vx/cache/compiled`, so any directory here is the user's.
 ])
@@ -275,7 +303,7 @@ function cantOpenIndex(dbFile: string, err: unknown): UserError | undefined {
 //        the memo simply stops answering wrongly, so an affected task's
 //        key moves from a WRONG value to the right one: it misses once,
 //        re-runs, re-caches. Self-healing, never a wrong hit.
-//   v25: runs.cached — whether the task declared a `cache` block. An
+//   v25: runs.cached — whether the task declared `cache: true`. An
 //        uncached task's row looked like any executed miss, so `vx why`
 //        headlined "cache key changed (inputs differ)" for a task that
 //        runs every time by design, and `vx last` could not mark it the
@@ -361,7 +389,23 @@ function cantOpenIndex(dbFile: string, err: unknown): UserError | undefined {
 //   v51: runs.queued_ms, output_bytes, blocks, flaky_passes and
 //        flaky_failures — the rest of what a results row shows, so `vx
 //        last --sql` reads it. The cache KEY is unchanged.
-export const SCHEMA_VERSION = 'v51'
+//   v52: entry_stdout.stdout is a zstd frame of the log's UTF-8, not its
+//        text: stored logs were half a store's bytes, more than every
+//        inline artifact. The cache KEY is unchanged.
+//   v53: a runs row names its run by its row in run_ids, not by the
+//        36-char text; a TEMP view `runs` shows run_id as before. An
+//        all-hit run of 500 tasks added 115 KB to the index. The cache
+//        KEY is unchanged.
+//   v54: entries.run_id — the run that wrote the entry, so `vx last
+//        --log` tells a run's own output from another run's under the same
+//        key. The cache KEY is unchanged.
+//   v55: output_stamps.mtime_ms — the mtime the file carried when
+//        stamped. A restore dates each file it writes now, as the task's
+//        write would, not with the entry's saved mtime: a make-style
+//        dependant took a restored upstream as older than its own output
+//        and saved bytes built from another upstream. The cache KEY and
+//        the stored artifact are unchanged.
+export const SCHEMA_VERSION = 'v55'
 
 /**
  * An entry's key components as its one `entry_inputs` row (v34): JSON
@@ -413,38 +457,50 @@ const ARTIFACT_TABLES = ['artifacts', 'artifacts_meta']
 const ARTIFACT_LAYOUT = 'a2'
 
 /**
- * An index that records a schema other than this vx's: the one an opener
- * that writes resets. Reads the recorded version alone and touches
- * nothing; an unreadable file is left to the open to refuse.
+ * A preview's index connection and the schema it records, which the open
+ * keeps and reuses. A version other than this vx's is the index an opener
+ * that writes resets; an unreadable file is left to the open to refuse.
  */
-function indexOfAnotherSchema(dbFile: string): boolean {
-  let found: string | undefined
+function previewIndex(dbFile: string): { db: Database; version: string | undefined } | undefined {
+  let db: Database
   try {
-    const db = new Database(dbFile, { readonly: true })
-    try {
-      found = (
-        db.query("SELECT value FROM schema_meta WHERE key = 'version'").get() as {
-          value: string
-        } | null
-      )?.value
-    } finally {
-      closeDb(db)
-    }
+    db = new Database(dbFile, { create: true })
   } catch {
-    return false
+    // The main open names why.
+    return undefined
+  }
+  try {
+    const version = (
+      db.prepare("SELECT value FROM schema_meta WHERE key = 'version'").get() as {
+        value: string
+      } | null
+    )?.value
+    return { db, version }
+  } catch {
+    // No stamp read (no table yet, busy, not a database): the main open
+    // reads it again and refuses what it must.
+    return { db, version: undefined }
   }
-  return found !== undefined && found !== SCHEMA_VERSION
 }
 
+/** The largest compressed log a probe loads with its entry. */
+const LOG_INLINE_BYTES = 4096
+
 /**
- * Each asked key's entry row with its stdout, which lives apart (v29), none
- * stored reading as '', and its inline artifact's last use, null when the
- * artifact is a file. Driven by the keys, so a key with an inline artifact
- * and no row (a reset kept it) answers too, `hash` null: the miss learns
- * there is something to adopt in the statement that found no entry.
+ * Each asked key's entry row, its stored log while that is small, and its
+ * inline artifact's last use, null when the artifact is a file. A larger
+ * log is only flagged (`stdout_apart`), and read when its hit replays: a
+ * warm run probes every key in one batch and replays the hits as the
+ * scheduler reaches them, so every log joined here was held until its
+ * replay (500 hits printing 1 MiB each held 3.4 GB). A small one rides
+ * along, still compressed: a read apart per hit cost a warm run of 300
+ * short logs ~1 ms of 44. `length` reads a blob's size, not its pages.
+ * Driven by the keys, so a key with an inline artifact and no row (a reset
+ * kept it) answers too, `hash` null: the miss learns there is something to
+ * adopt in the statement that found no entry.
  */
 const selectEntries = (keys: string): string =>
-  `SELECT q.value AS key, e.*, COALESCE(s.stdout, '') AS stdout, a.at AS inline_at FROM ${keys} q LEFT JOIN entries e ON e.hash = q.value LEFT JOIN entry_stdout s ON s.hash = e.hash LEFT JOIN artifacts a ON a.hash = q.value WHERE e.hash IS NOT NULL OR a.at IS NOT NULL`
+  `SELECT q.value AS key, e.*, CASE WHEN length(s.stdout) <= ${LOG_INLINE_BYTES} THEN s.stdout END AS stdout, length(s.stdout) > ${LOG_INLINE_BYTES} AS stdout_apart, a.at AS inline_at FROM ${keys} q LEFT JOIN entries e ON e.hash = q.value LEFT JOIN entry_stdout s ON s.hash = e.hash LEFT JOIN artifacts a ON a.hash = q.value WHERE e.hash IS NOT NULL OR a.at IS NOT NULL`
 const SELECT_ENTRY = selectEntries('(SELECT ? AS value)')
 const SELECT_ENTRIES = selectEntries('json_each(?)')
 
@@ -610,7 +666,10 @@ interface EntryRow {
   exit_code: number
   duration_ms: number
   size_bytes: number
-  stdout: string
+  /** The compressed log when no more than `LOG_INLINE_BYTES`, else null. */
+  stdout: Uint8Array | null
+  /** 1 when the log is larger, and read apart; null when none was stored. */
+  stdout_apart: number | null
   created_at: number
   accessed_at: number
   cpu_ms: number | null
@@ -618,24 +677,45 @@ interface EntryRow {
   inline_at: number | null
 }
 
-function entryOf(row: LiveRow, fileRows: OutputFileRow[]): CacheEntry {
-  return {
+/**
+ * The entry a row answers. Its log is a getter, decompressed on each access
+ * and, past `LOG_INLINE_BYTES`, read from the index then (`log`), so an
+ * entry held from the probe to its replay holds no log text and the replay
+ * drops it once printed. A reader takes it once.
+ */
+function entryOf(
+  row: LiveRow,
+  fileRows: OutputFileRow[],
+  log: (hash: string) => string,
+): CacheEntry {
+  // Assigned, not spread, and the date formatted only when read: a warm
+  // run's probe builds one per hit and reads neither (~4 ms of 8,002
+  // entries, 2026-11-07).
+  const entry: CacheEntry = {
     hash: row.hash,
     taskId: `${row.project}#${row.task}`,
     command: row.command,
     exitCode: row.exit_code,
     durationMs: row.duration_ms,
     sizeBytes: row.size_bytes,
-    ...(row.cpu_ms !== null ? { cpuMs: row.cpu_ms } : {}),
-    ...(row.peak_rss_bytes !== null ? { peakRssBytes: row.peak_rss_bytes } : {}),
     outputFiles: fileRows.map((r) => r.path),
     outputRows: fileRows,
-    stdout: row.stdout,
-    storedAt: new Date(row.created_at).toISOString(),
+    get stdout() {
+      return row.stdout_apart === 1 ? log(row.hash) : storedLog(row.stdout)
+    },
+    get storedAt() {
+      return new Date(row.created_at).toISOString()
+    },
     source: 'local',
   }
+  if (row.cpu_ms !== null) entry.cpuMs = row.cpu_ms
+  if (row.peak_rss_bytes !== null) entry.peakRssBytes = row.peak_rss_bytes
+  return entry
 }
 
+/** Why a reading handle (`'inspect'`, `'preview'`) writes nothing: no index to read was there. */
+const NO_INDEX = 'no index there yet'
+
 /** The sidecar's `exec` from a save's entry: only the axes the runner reported. */
 function usageOfEntry(entry: { cpuMs?: number; peakRssBytes?: number }): ExecUsage | undefined {
   if (entry.cpuMs === undefined && entry.peakRssBytes === undefined) return undefined
@@ -657,7 +737,8 @@ function usageOfEntry(entry: { cpuMs?: number; peakRssBytes?: number }): ExecUsa
  * failure is another question's answer: `access` on the directory is also
  * "does it exist" (made only on ENOENT), `access` on the database also "is
  * it there", and the ignore file is created exclusively instead of probed
- * first. An existing cache costs three calls; it cost six.
+ * first. An existing cache costs three calls, it cost six, and two more
+ * resolve it (`refuseForeignCacheDir`).
  */
 function openCacheDir(cacheDir: string, workspaceRoot?: string, index = 'cache.db'): string | null {
   const [ignore, ignoreText] = ignoreFileFor(cacheDir)
@@ -678,12 +759,17 @@ function openCacheDir(cacheDir: string, workspaceRoot?: string, index = 'cache.d
     if (code !== 'ENOENT') return errorText(err)
     refuseManifestDir(cacheDir, workspaceRoot)
   }
+  if (index === 'cache.db') refuseForeignCacheDir(cacheDir, workspaceRoot)
   writeIgnore(ignore, ignoreText)
   return null
 }
 
-/** `openCacheDir` for the shared store: why it cannot be used, or null. Never throws. */
-function storeBlocked(storeDir: string, storeRoot: string | null): string | null {
+/**
+ * `openCacheDir` for the shared store: why it cannot be used, or null. Never
+ * throws. `make` false asks the same question and makes or changes
+ * nothing, so a reading verb settles where the entries are as a run does.
+ */
+function storeBlocked(storeDir: string, storeRoot: string | null, make: boolean): string | null {
   try {
     if (storeRoot !== null) {
       // `~/.vx`, `~/.vx/<id>`, `~/.vx/<id>/cache`: owner-only, each level
@@ -691,21 +777,53 @@ function storeBlocked(storeDir: string, storeRoot: string | null): string | null
       // replayed into the workspace, so nobody else may write them.
       const vxHome = path.dirname(path.dirname(storeRoot))
       for (const dir of [vxHome, path.dirname(storeRoot), storeRoot]) {
-        const refused = ensurePrivateDir(dir)
+        // The levels below one not made yet are made by this user, 0700.
+        if (!make && lstatSync(dir, { throwIfNoEntry: false }) === undefined)
+          return mkdirBlocked(dir, false)
+        const refused = ensurePrivateDir(dir, make)
         if (refused !== null) return refused
       }
     }
-    return openCacheDir(storeDir, undefined, 'store.db')
+    if (make) return openCacheDir(storeDir, undefined, 'store.db')
+    try {
+      accessSync(storeDir, constants.W_OK)
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') return errorText(err)
+      return mkdirBlocked(storeDir, true)
+    }
+    try {
+      accessSync(path.join(storeDir, 'store.db'), constants.W_OK)
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') return errorText(err)
+      refuseManifestDir(storeDir, undefined)
+    }
+    return null
   } catch (err) {
     return errorText(err)
   }
 }
 
-function ensurePrivateDir(dir: string): string | null {
+/** Why `mkdir` (`-p` with `recursive`) of `dir` would fail, asked without making it. */
+function mkdirBlocked(dir: string, recursive: boolean): string | null {
+  let up = path.dirname(dir)
+  if (recursive)
+    while (lstatSync(up, { throwIfNoEntry: false }) === undefined) up = path.dirname(up)
   try {
-    mkdirSync(dir, { mode: 0o700 })
+    if (!statSync(up).isDirectory()) return `${up} is not a directory`
+    accessSync(up, constants.W_OK)
+    return null
   } catch (err) {
-    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') return errorText(err)
+    return errorText(err)
+  }
+}
+
+function ensurePrivateDir(dir: string, make: boolean): string | null {
+  if (make) {
+    try {
+      mkdirSync(dir, { mode: 0o700 })
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EEXIST') return errorText(err)
+    }
   }
   const st = lstatSync(dir)
   if (!st.isDirectory()) return `${dir} is not a directory`
@@ -717,7 +835,7 @@ function ensurePrivateDir(dir: string): string | null {
   // The user's own directory open to others (a `~/.vx` made at the
   // default umask, 0755) is vx's to close: refusing it left the store
   // unused on a stock macOS home (2026-10-06: "you should own it").
-  if ((st.mode & 0o077) !== 0) {
+  if (make && (st.mode & 0o077) !== 0) {
     try {
       chmodSync(dir, 0o700)
     } catch (err) {
@@ -813,8 +931,6 @@ const MANIFESTS = [
   ...['ts', 'mts', 'js', 'mjs', 'cts', 'cjs'].map((ext) => `vx.config.${ext}`),
   ...['ts', 'mts', 'js', 'mjs', 'cts', 'cjs'].map((ext) => `.vx/workspace.${ext}`),
 ]
-const OWN_DIR_HINT =
-  'Point `cache.dir` in .vx/workspace.ts (or --cache-dir) at a directory of its own, such as .vx/cache.'
 
 function makeCacheDir(cacheDir: string): void {
   try {
@@ -908,6 +1024,43 @@ export interface RemoteTraffic {
   readonly keys: Map<string, RemoteKeyTraffic>
 }
 
+/**
+ * Core's own cache's `hashFile`, also told the ctime of the stat its digest
+ * came from (`hashFileSeen`). Kept off `CacheLayer`, a public type: another
+ * layer has none here.
+ */
+const seenHashers = new WeakMap<
+  CacheLayer,
+  {
+    /** The layer's `hashFile` when it registered: one replaced since is not this. */
+    method: CacheLayer['hashFile']
+    hash: (file: string, seen: (ctimeMs: number) => void) => Promise<string>
+  }
+>()
+
+/**
+ * `layer.hashFile(file)`, and `seen` told the ctime of the stat the digest
+ * came from when the layer is core's own cache (the re-check's tie rule,
+ * `InputFact.ctimeMs`). Any other layer tells nothing, and so does one
+ * whose `hashFile` was replaced since.
+ */
+export function hashFileSeen(
+  layer: CacheLayer,
+  file: string,
+  seen: (ctimeMs: number) => void,
+): Promise<string> {
+  const own = seenHashers.get(layer)
+  return own === undefined || own.method !== layer.hashFile
+    ? layer.hashFile(file)
+    : own.hash(file, seen)
+}
+
+/** `to` answers `hashFileSeen` as `from` does: a layer over core's cache. */
+export function shareSeenHasher(from: CacheLayer, to: CacheLayer): void {
+  const own = seenHashers.get(from)
+  if (own !== undefined) seenHashers.set(to, { method: to.hashFile, hash: own.hash })
+}
+
 export class Cache implements CacheLayer {
   /** This IS the local layer — there is nothing slower behind it. */
   readonly hasRemote = false
@@ -928,6 +1081,8 @@ export class Cache implements CacheLayer {
   private readonly selectEntry: ReturnType<Database['prepare']>
   private readonly upsertStdout: ReturnType<Database['prepare']>
   private readonly deleteStdout: ReturnType<Database['prepare']>
+  private readonly selectStdout: ReturnType<Database['prepare']>
+  private readonly logOf = (hash: string): string => this.guard(() => this.stdoutText(hash))
   private readonly entryExists: ReturnType<Database['prepare']>
   private readonly selectBlob: ReturnType<Database['prepare']>
   private readonly upsertBlob: ReturnType<Database['prepare']>
@@ -942,6 +1097,12 @@ export class Cache implements CacheLayer {
    * serves those rows only while the blob still carries it.
    */
   private readonly heldInlineAt = new Map<string, number>()
+  /**
+   * The mtime each file the last restore of a key left, by row path
+   * (`extractArtifactStream`'s `dated`): its stamps take that, not the
+   * row's saved one. Taken by `recordOutputStamps`.
+   */
+  private readonly datedMtimes = new Map<string, Map<string, number>>()
   /** Keys the last lookups found an inline artifact for and no row: `adopt`'s to read. */
   private readonly rowless = new Set<string>()
   /** Row-less lookups that stat'ed their artifact path (`artifactFileMayExist`). */
@@ -952,7 +1113,14 @@ export class Cache implements CacheLayer {
   private heldTimer: ReturnType<typeof setTimeout> | undefined
   /** Saves' index writes waiting for this turn's one transaction (`indexInBatch`). */
   private indexQueue: Array<{ write: () => void; settle: (err?: unknown) => void }> = []
-  private heldRest: () => Array<[string, number]> = () => []
+  /**
+   * The held sizes being stored, `oid\0size` in OID order, and how many
+   * are: fields, not a closure's, so the store lets them go.
+   */
+  private storing: string[] | undefined
+  private stored = 0
+  /** The checkpoint thread: `armed` until a save commits (`checkpointOffThread`). */
+  private checkpoints: 'armed' | WalCheckpointer | undefined
   private readonly insertEntryInput: ReturnType<Database['prepare']>
   /** The per-file (mtime, size) → blob-OID memo behind `hashFile`. */
   private readonly files: FileHashStore
@@ -963,6 +1131,10 @@ export class Cache implements CacheLayer {
    * principle 9). Taken once, by `outputBytes`.
    */
   private readonly savedBytes = new Map<string, number>()
+  /** Each key a `--force` save found stored and kept: no save of this run's. Taken once, by `kept`. */
+  private readonly keptHashes = new Set<string>()
+  /** The run this cache saves for: each entry it writes records it (`entries.run_id`). */
+  runId: string | undefined
   private readonly folds: IndexFoldMemo
   private readonly history: RunHistory
   /** What the remotes said they hold, across runs (remote-hits.ts). */
@@ -998,13 +1170,6 @@ export class Cache implements CacheLayer {
    */
   readonly schemaReset: SchemaReset | null = null
 
-  /**
-   * Set when THIS open found entries written under another
-   * `CACHE_VERSION`: the index survives, but no old key is derived again,
-   * so every cached task misses once. Not printed, like `schemaReset`.
-   */
-  readonly formatChange: SchemaReset | null = null
-
   /**
    * Set when THIS open found the shared store written under another
    * `SCHEMA_VERSION` and dropped its inventory; the artifacts stay and are
@@ -1033,9 +1198,10 @@ export class Cache implements CacheLayer {
     /**
      * `'inspect'`: a reading verb (`why`, `last`, `info`). It never resets
      * the index: a schema it cannot read is refused, named, and left as it
-     * was. `'preview'`: a dry prune, which reads such an index as the reset
-     * the real prune does first leaves it, empty, with the store still
-     * reached, so it names what that prune takes (item 1083).
+     * was. `'preview'`: a dry prune or a `--dry` plan, which reads such an
+     * index as the reset the real prune or run does first leaves it, empty,
+     * with the store still reached, so it names what that prune takes
+     * (item 1083).
      */
     mode: 'open' | 'inspect' | 'preview' = 'open',
     /**
@@ -1044,8 +1210,7 @@ export class Cache implements CacheLayer {
      * and the store's own schema is `store_meta.schema` (`matchStoreSchema`). Or
      * `null` for an index that holds its entries itself (a `cacheDir`).
      * Undefined follows the layout the index records: a reading verb, a
-     * plugin's handle. A reading open reads it only where the index
-     * records none (deleted, or never written beside a run's store).
+     * plugin's handle.
      */
     storeRoot?: string | null,
     private readonly store: StoreOptions = DEFAULT_STORE,
@@ -1065,10 +1230,20 @@ export class Cache implements CacheLayer {
     // said "no recorded runs yet" (item 900).
     const dbFile = path.join(cacheDir, 'cache.db')
     this.dbFile = dbFile
-    const absent =
-      mode !== 'open' &&
-      (!existsSync(dbFile) || (mode === 'preview' && indexOfAnotherSchema(dbFile)))
-    this.writeBlocked = absent ? 'no index there yet' : openCacheDir(cacheDir, repoDir)
+    let absent = mode !== 'open' && !existsSync(dbFile)
+    // A preview reads an index of another schema as the empty one a reset
+    // leaves. The version is read on the connection the index keeps, once:
+    // a second connection for it cost a plan a statement (perf-guard).
+    let early: { db: Database; version: string | undefined } | undefined
+    if (mode === 'preview' && !absent) {
+      early = previewIndex(dbFile)
+      if (early !== undefined && early.version !== undefined && early.version !== SCHEMA_VERSION) {
+        closeDb(early.db)
+        early = undefined
+        absent = true
+      }
+    }
+    this.writeBlocked = absent ? NO_INDEX : openCacheDir(cacheDir, repoDir)
     this.write = localPolicy.write && this.writeBlocked === null
     // A directory this user cannot write with no index in it yet: SQLite
     // cannot make one, and its `unable to open database file` stack reached
@@ -1078,7 +1253,7 @@ export class Cache implements CacheLayer {
     const memory = absent || (this.writeBlocked !== null && !existsSync(dbFile))
     this.empty = memory
     try {
-      this.db = new Database(memory ? ':memory:' : dbFile, { create: true })
+      this.db = early?.db ?? new Database(memory ? ':memory:' : dbFile, { create: true })
     } catch (err) {
       throw cantOpenIndex(dbFile, err) ?? err
     }
@@ -1173,7 +1348,7 @@ export class Cache implements CacheLayer {
         )
       }
     }
-    const current = readable(readVersion)
+    const current = early?.version ?? readable(readVersion)
     if (current !== SCHEMA_VERSION) {
       try {
         if (current !== undefined) refuseUnreadable(current)
@@ -1187,7 +1362,7 @@ export class Cache implements CacheLayer {
             // keeps it so).
             if (found !== undefined) {
               this.db.exec(
-                'DROP TABLE IF EXISTS main.entries; DROP TABLE IF EXISTS main.runs; DROP TABLE IF EXISTS main.file_hashes; DROP TABLE IF EXISTS main.blob_sizes; DROP TABLE IF EXISTS main.blob_verdicts; DROP TABLE IF EXISTS main.output_files; DROP TABLE IF EXISTS main.output_stamps; DROP TABLE IF EXISTS main.invocations; DROP TABLE IF EXISTS main.run_task_inputs; DROP TABLE IF EXISTS main.entry_inputs; DROP TABLE IF EXISTS main.config_evals; DROP TABLE IF EXISTS main.config_closures; DROP TABLE IF EXISTS main.output_dirs; DROP TABLE IF EXISTS main.entry_stdout; DROP TABLE IF EXISTS main.task_durations; DROP TABLE IF EXISTS main.plugin_blobs; DROP TABLE IF EXISTS main.task_outcomes; DROP TABLE IF EXISTS main.store_meta; DROP TABLE IF EXISTS main.fold_memo; DROP TABLE IF EXISTS main.remote_hits; DROP TABLE IF EXISTS main.steps; DROP TABLE IF EXISTS main.warnings; DROP TABLE IF EXISTS main.failures; DROP TABLE IF EXISTS main.lockfile_memos;',
+                'DROP TABLE IF EXISTS main.entries; DROP TABLE IF EXISTS main.runs; DROP TABLE IF EXISTS main.file_hashes; DROP TABLE IF EXISTS main.blob_sizes; DROP TABLE IF EXISTS main.blob_verdicts; DROP TABLE IF EXISTS main.output_files; DROP TABLE IF EXISTS main.output_stamps; DROP TABLE IF EXISTS main.invocations; DROP TABLE IF EXISTS main.run_task_inputs; DROP TABLE IF EXISTS main.entry_inputs; DROP TABLE IF EXISTS main.config_evals; DROP TABLE IF EXISTS main.config_closures; DROP TABLE IF EXISTS main.output_dirs; DROP TABLE IF EXISTS main.entry_stdout; DROP TABLE IF EXISTS main.task_durations; DROP TABLE IF EXISTS main.plugin_blobs; DROP TABLE IF EXISTS main.task_outcomes; DROP TABLE IF EXISTS main.store_meta; DROP TABLE IF EXISTS main.fold_memo; DROP TABLE IF EXISTS main.remote_hits; DROP TABLE IF EXISTS main.steps; DROP TABLE IF EXISTS main.warnings; DROP TABLE IF EXISTS main.failures; DROP TABLE IF EXISTS main.lockfile_memos; DROP TABLE IF EXISTS main.run_ids;',
               )
             }
             // The tables land under the same write lock as the stamp: made
@@ -1230,25 +1405,22 @@ export class Cache implements CacheLayer {
           } | null
         )?.value,
     )
-    // A dry prune names what the real one takes, so it reads the store a
-    // run opens (today's), not the one the index last recorded.
-    let storeDir =
-      mode === 'inspect'
-        ? (recorded ?? (typeof storeRoot === 'string' ? storeRoot : undefined))
-        : storeRoot === undefined
-          ? recorded
-          : storeRoot === null
-            ? undefined
-            : storeRoot
-    if (storeDir !== undefined && mode === 'open' && this.writeBlocked === null) {
-      const blocked = storeBlocked(storeDir, typeof storeRoot === 'string' ? storeRoot : null)
-      if (blocked !== null) {
+    // A store named by the caller is the one a run opens (today's), and
+    // every mode reads it: a dry prune names what the real one takes, and
+    // `vx info` the store the next run fills, not one a moved HOME left.
+    let storeDir = storeRoot === undefined ? recorded : (storeRoot ?? undefined)
+    // Every mode settles the store as a run does, the reading ones without
+    // touching it: `vx info` and a dry prune read the entries runs use, not
+    // a store another user owns (one `sudo vx run`).
+    const root = typeof storeRoot === 'string' ? storeRoot : null
+    if (storeDir !== undefined && (this.writeBlocked === null || absent)) {
+      if (storeBlocked(storeDir, root, mode === 'open') !== null) {
         // A home this user cannot write (a container, a read-only mount):
         // the entries stay in this workspace rather than fail the run.
         const fallback = cacheDir
         if (fallback !== storeDir) {
           storeDir = fallback
-          openCacheDir(fallback)
+          if (mode === 'open') openCacheDir(fallback)
         }
       }
     }
@@ -1269,7 +1441,9 @@ export class Cache implements CacheLayer {
     this.storeDir = storeDir
     this.artifactDir = storeDir ?? cacheDir
     if (storeDir !== undefined) {
-      this.attachStore(storeDir, mode !== 'open')
+      this.attachStore(storeDir, mode !== 'open', (dir) =>
+        dir === cacheDir ? openCacheDir(dir) : storeBlocked(dir, root, true),
+      )
       this.storeReset = this.matchStoreSchema(mode === 'open' && this.writeBlocked === null)
     } else {
       createTables(this.db, 'main')
@@ -1295,8 +1469,8 @@ export class Cache implements CacheLayer {
     this.insertEntry = lazyStatement(
       this.db,
       `
-      INSERT INTO entries(hash, project, task, command, exit_code, duration_ms, size_bytes, created_at, accessed_at, cpu_ms, peak_rss_bytes)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      INSERT INTO entries(hash, project, task, command, exit_code, duration_ms, size_bytes, created_at, accessed_at, cpu_ms, peak_rss_bytes, run_id)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(hash) DO UPDATE SET
         project        = excluded.project,
         task           = excluded.task,
@@ -1306,14 +1480,17 @@ export class Cache implements CacheLayer {
         size_bytes     = excluded.size_bytes,
         accessed_at    = excluded.accessed_at,
         cpu_ms         = excluded.cpu_ms,
-        peak_rss_bytes = excluded.peak_rss_bytes
+        peak_rss_bytes = excluded.peak_rss_bytes,
+        created_at     = excluded.created_at,
+        run_id         = excluded.run_id
     `,
     )
     this.upsertStdout = lazyStatement(
       this.db,
-      'INSERT INTO entry_stdout(hash, stdout) VALUES (?, CAST(? AS TEXT)) ON CONFLICT(hash) DO UPDATE SET stdout = excluded.stdout',
+      'INSERT INTO entry_stdout(hash, stdout) VALUES (?, ?) ON CONFLICT(hash) DO UPDATE SET stdout = excluded.stdout',
     )
     this.deleteStdout = lazyStatement(this.db, 'DELETE FROM entry_stdout WHERE hash = ?')
+    this.selectStdout = lazyStatement(this.db, 'SELECT stdout FROM entry_stdout WHERE hash = ?')
     this.selectEntry = lazyStatement(this.db, SELECT_ENTRY)
     // `has` asks only whether the row is there and where its artifact is,
     // with no stdout joined. A column off the index, so the table row is
@@ -1342,23 +1519,23 @@ export class Cache implements CacheLayer {
     // The slices: each owns its statements over this handle and its table(s);
     // the schema above is the one place every table is declared.
     this.files = new FileHashStore(this.db, cacheDir, this.write, repoDir)
+    seenHashers.set(this, {
+      method: this.hashFile,
+      hash: (file, seen) => this.guard(() => this.files.hashFile(file, seen)),
+    })
     this.outputs = new OutputIndex(this.db, this.writeBlocked === null && !this.inspecting)
     this.folds = new IndexFoldMemo(this.db, this.write && !this.inspecting)
     this.history = new RunHistory(this.db, (v) => this.digestValue(v))
     this.remoteHits = new IndexRemoteHits(this.db, this.writeBlocked === null && !this.inspecting)
 
     // A CACHE_VERSION bump keeps the index but moves every key, so the run
-    // after an upgrade misses everything. Roadmap 3.3: that is announced,
-    // never silent. A store with no recorded version and no entries is
-    // new; one with entries predates the record (item 671).
+    // after an upgrade misses everything, in silence: the cache is vx's to
+    // keep (2026-10-06). The version is recorded for whoever reads the
+    // index by hand; a reading verb writes nothing (item 1080).
     const format = this.db
       .prepare("SELECT value FROM schema_meta WHERE key = 'cache_version'")
       .get() as { value: string } | null
     if (format?.value !== CACHE_VERSION && this.writeBlocked === null && !this.inspecting) {
-      const hasEntries = this.db.prepare('SELECT 1 FROM entries LIMIT 1').get() != null
-      if (this.schemaReset === null && (format !== null || hasEntries)) {
-        this.formatChange = { from: format?.value ?? 'an earlier format', to: CACHE_VERSION }
-      }
       this.db
         .prepare(
           "INSERT INTO schema_meta(key, value) VALUES ('cache_version', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
@@ -1472,25 +1649,59 @@ export class Cache implements CacheLayer {
    * WAL for both, so a workspace's run and another's share the store as
    * two runs on one `--cache-dir` share an index. A reading verb over a
    * store with no file or no tables yet reads an empty one in memory.
+   *
+   * Every checkout of a repository shares its store, each with a run lock
+   * of its own, and a `vx cache clean` in one holds the store alone
+   * (`holdStore`) until it has deleted it. A writing open meeting that hold
+   * answers SQLITE_BUSY within a second, for its caller to wait and open
+   * again (prepare.ts). One let in once the clean let go opened the
+   * store.db the clean unlinked, and saved its entry into it: it makes the
+   * store again (`remake`, private and ignored) and opens that. Once in,
+   * its lock keeps a clean out until it closes.
    */
-  private attachStore(storeDir: string, inspecting: boolean): void {
+  private attachStore(
+    storeDir: string,
+    inspecting: boolean,
+    remake: (dir: string) => string | null,
+  ): void {
     const storeFile = path.join(storeDir, 'store.db')
     let absent = inspecting && !existsSync(storeFile)
     try {
-      this.db.prepare('ATTACH DATABASE ? AS store').run(absent ? ':memory:' : storeFile)
-      // One with no tables yet is read empty in memory too: the journal
-      // switch and the table creation below are writes, under no write
-      // lock, racing an opener making that store.
-      if (
-        inspecting &&
-        !absent &&
-        this.db.prepare("SELECT 1 FROM store.sqlite_master WHERE name = 'entries'").get() == null
-      ) {
+      for (let retried = false; ;) {
+        // The attach reads the store's schema: its first lock on it.
+        if (!inspecting) this.db.exec('PRAGMA busy_timeout = 1000')
+        try {
+          this.db.prepare('ATTACH DATABASE ? AS store').run(absent ? ':memory:' : storeFile)
+        } catch (err) {
+          // A file whose directory went: SQLite cannot open its -wal there.
+          const busy = (err as { code?: unknown }).code === 'SQLITE_BUSY'
+          if (inspecting || busy || retried || remake(storeDir) !== null) throw err
+          retried = true
+          continue
+        }
+        // One with no tables yet is read empty in memory too: the journal
+        // switch and the table creation below are writes, under no write
+        // lock, racing an opener making that store.
+        if (
+          inspecting &&
+          !absent &&
+          this.db.prepare("SELECT 1 FROM store.sqlite_master WHERE name = 'entries'").get() == null
+        ) {
+          this.db.exec('DETACH DATABASE store')
+          this.db.prepare('ATTACH DATABASE ? AS store').run(':memory:')
+          absent = true
+        }
+        this.db.exec('PRAGMA store.journal_mode = WAL')
+        if (inspecting) break
+        this.db.exec('PRAGMA busy_timeout = 5000')
+        // One stat, SQLite's: is the file open still the one at its name?
+        const moved = new Int32Array(2)
+        this.db.fileControl('store', SQLITE_FCNTL_HAS_MOVED, moved)
+        if (moved[0] === 0) break
         this.db.exec('DETACH DATABASE store')
-        this.db.prepare('ATTACH DATABASE ? AS store').run(':memory:')
-        absent = true
+        const refused = remake(storeDir)
+        if (refused !== null) throw new Error(`${storeFile} was deleted, and ${refused}`)
       }
-      this.db.exec('PRAGMA store.journal_mode = WAL')
       if (!absent) this.db.fileControl('store', SQLITE_FCNTL_PERSIST_WAL, 1)
       this.db.exec('PRAGMA store.journal_size_limit = 67108864')
       this.db.exec('PRAGMA store.synchronous = NORMAL')
@@ -1670,13 +1881,46 @@ export class Cache implements CacheLayer {
     const held = this.heldBlobSizes
     this.heldBlobSizes = undefined
     if (held === undefined || held.length === 0) return
-    let at = 0
-    const step = (): void => {
-      this.guard(() => this.files.rememberBlobSizes(new Map(held.slice(at, (at += HELD_SLICE)))))
-      this.heldTimer = at < held.length ? setTimeout(step, 0) : undefined
+    // In OID order, so each slice appends at the key index's right edge:
+    // in git's path order every slice dirtied pages across the whole
+    // index, and the 160 commits of a cold 9,603-task run cost its main
+    // thread ~5x more (2026-11-06). Sorted as `oid\0size` strings with no
+    // comparator: a JS comparator over 40,000 entries was 32 ms of a cold
+    // 8,002-task run's main thread before its first task, the native
+    // string sort 8 (2026-11-07). `\0` sorts below every OID character,
+    // so the order is the OIDs'. No entry outlives this: the strings are
+    // all the store keeps.
+    const keys: string[] = []
+    for (let i = 0; i < held.length; i++) keys.push(`${held[i]![0]}\0${held[i]![1]}`)
+    keys.sort()
+    this.storing = keys
+    this.stored = 0
+    this.heldTimer = setTimeout(this.storeHeldSlice, 0)
+  }
+
+  // A closure over the sizes kept all of them while anything held it (the
+  // rest's getter, a fired timer's callback): a cold 9,603-task run's
+  // 38,331 to its end, ~5 MB of heap (2026-11-06).
+  private readonly storeHeldSlice = (): void => {
+    const held = this.storing
+    if (held === undefined) return
+    const at = this.stored
+    this.stored = at + HELD_SLICE
+    this.guard(() => this.files.rememberBlobSizes(this.heldSizes(held, at, this.stored)))
+    if (this.stored < held.length) this.heldTimer = setTimeout(this.storeHeldSlice, 0)
+    else {
+      this.heldTimer = undefined
+      this.storing = undefined
     }
-    this.heldRest = () => held.slice(at)
-    this.heldTimer = setTimeout(step, 0)
+  }
+  private heldSizes(held: readonly string[], from: number, to: number): Map<string, number> {
+    const out = new Map<string, number>()
+    for (let i = from; i < Math.min(to, held.length); i++) {
+      const k = held[i]!
+      const at = k.indexOf('\0')
+      out.set(k.slice(0, at), Number(k.slice(at + 1)))
+    }
+    return out
   }
   /** `BlobSizeMemo`: the paths an index with this digest distrusts, when known. */
   blobVerdict(digest: string): string[] | undefined {
@@ -1908,7 +2152,7 @@ export class Cache implements CacheLayer {
     // for four up-to-date hits on ~70 MB binaries). restoreOutputs
     // reads the artifact itself, only when extraction actually runs.
     const fileRows = this.loadOutputFilesBatch([hash]).get(hash) ?? []
-    const entry = entryOf(row as LiveRow, fileRows)
+    const entry = entryOf(row as LiveRow, fileRows, this.logOf)
     entry.outputDirRows = this.loadOutputDirsBatch([hash]).get(hash) ?? []
     return entry
   }
@@ -1967,32 +2211,40 @@ export class Cache implements CacheLayer {
         ? [this.selectEntry.get(hashes[0]!)].filter((r) => r !== null)
         : this.db.query(SELECT_ENTRIES).all(JSON.stringify(hashes))
     ) as EntryRow[]
-    const rows: LiveRow[] = []
-    for (const r of found) {
-      if (r.hash === null) this.rowless.add(r.key)
-      else rows.push(r as LiveRow)
-    }
-    if (rows.length === 0) return out
     const graceStart = Date.now() - ORPHAN_GRACE_MS
     const refreshStart = Date.now() - ACCESS_REFRESH_MS
-    const live = rows.filter((r) => {
+    // A hash asked twice is one row here: the output queries join from the
+    // live hashes as given (`loadOutputFilesBatch`'s `distinct`).
+    const seen = new Set<string>()
+    const live: LiveRow[] = []
+    const liveHashes: string[] = []
+    for (const r of found) {
+      if (r.hash === null) {
+        this.rowless.add(r.key)
+        continue
+      }
+      if (seen.has(r.hash)) continue
+      seen.add(r.hash)
       if (r.inline_at !== null) {
         if (r.inline_at < graceStart) this.staleInline.add(r.hash)
-        return true
+      } else {
+        const st = this.artifactStat(r.hash)
+        if (st === undefined) continue
+        if (st.mtimeMs < graceStart) this.staleTimes.add(r.hash)
       }
-      const st = this.artifactStat(r.hash)
-      if (st !== undefined && st.mtimeMs < graceStart) this.staleTimes.add(r.hash)
-      return st !== undefined
-    })
-    const liveHashes = live.map((r) => r.hash)
-    const fileRows = this.loadOutputFilesBatch(liveHashes)
+      live.push(r as LiveRow)
+      liveHashes.push(r.hash)
+    }
+    if (seen.size === 0) return out
+    const distinct = JSON.stringify(liveHashes)
+    const fileRows = this.outputs.loadOutputFilesBatch(liveHashes, distinct)
     this.outputs.hold(fileRows)
     this.heldInlineAt.clear()
     for (const r of live) if (r.inline_at !== null) this.heldInlineAt.set(r.hash, r.inline_at)
-    const dirRows = this.loadOutputDirsBatch(liveHashes)
+    const dirRows = this.outputs.loadOutputDirsBatch(liveHashes, distinct)
     for (const row of live) {
       if (row.accessed_at < refreshStart) this.touched.add(row.hash)
-      const entry = entryOf(row, fileRows.get(row.hash) ?? [])
+      const entry = entryOf(row, fileRows.get(row.hash) ?? [], this.logOf)
       entry.outputDirRows = dirRows.get(row.hash) ?? []
       out.set(row.hash, entry)
     }
@@ -2054,6 +2306,9 @@ export class Cache implements CacheLayer {
     this.savedBytes.delete(hash)
     return bytes
   }
+  kept(hash: string): boolean {
+    return this.keptHashes.delete(hash)
+  }
   artifactSize(hash: string): number | undefined {
     return this.guard(
       () =>
@@ -2074,7 +2329,9 @@ export class Cache implements CacheLayer {
     await this.outputs.recordOutputDirs(hash, projectDir, prefixes, holds)
   }
   recordOutputStamps(hash: string, projectDir: string, workspaceRoot: string): void {
-    this.outputs.recordOutputStamps(hash, projectDir, workspaceRoot)
+    const dated = this.datedMtimes.get(hash)
+    this.datedMtimes.delete(hash)
+    this.outputs.recordOutputStamps(hash, projectDir, workspaceRoot, dated)
   }
   loadOutputDirsBatch(hashes: readonly string[]): Map<string, OutputDirRow[]> {
     return this.guard(() => this.outputs.loadOutputDirsBatch(hashes))
@@ -2088,23 +2345,52 @@ export class Cache implements CacheLayer {
     workspaceRoot?: string,
     outputs?: DeclaredOutputs,
   ): Promise<void> {
+    const used: { rows: readonly OutputFileRow[] } = { rows: [] }
     try {
-      await this.restoreOutputsOnce(hash, projectDir, workspaceRoot, outputs)
+      await this.restoreOutputsOnce(hash, projectDir, workspaceRoot, outputs, used, false)
     } catch (err) {
       if (!(err instanceof CorruptArtifactError)) throw err
+      let failed = err
+      // A file artifact has no `at` to say a re-save in another process
+      // replaced it since the probe: the probe's rows then name another
+      // build's files, and this one reads as corrupt. Rows that changed
+      // since are that race, so the restore runs once more on the rows read
+      // now, and an entry is dropped only while its rows are the ones that
+      // failed: another process's fresh entry is never taken.
+      if (this.entryChanged(hash, used.rows)) {
+        try {
+          await this.restoreOutputsOnce(hash, projectDir, workspaceRoot, outputs, used, true)
+          return
+        } catch (again) {
+          if (!(again instanceof CorruptArtifactError)) throw again
+          failed = again
+        }
+      }
       // Bad bytes under a good key failed the task on every run until
       // `--force`, since nothing rewrote them (J's lead, nx#30338). The
       // entry goes, and the caller runs the task, whose save stores it
       // again; running is always correct, only slower than a hit.
-      if (this.write) await this.dropEntry(hash)
+      if (this.write && !(await this.dropUnchanged(hash, used.rows)))
+        throw new ArtifactVanishedError(hash)
       throw new ArtifactVanishedError(
         hash,
-        `${err.message}; ${this.write ? 'dropped it' : 'left it (this cache is read-only)'}`,
-        err,
+        `${failed.message}; ${this.write ? 'dropped it' : 'left it (this cache is read-only)'}`,
+        failed,
       )
     }
   }
 
+  /** Whether `hash`'s committed rows are no longer `rows` (path, size, mode, mtime). */
+  private entryChanged(hash: string, rows: readonly OutputFileRow[]): boolean {
+    const now = this.guard(() => this.outputs.loadOutputFilesBatch([hash]).get(hash) ?? [])
+    if (now.length !== rows.length) return true
+    const was = new Map(rows.map((r) => [r.path, r]))
+    return now.some((r) => {
+      const w = was.get(r.path)
+      return w === undefined || w.size !== r.size || w.mode !== r.mode || w.mtimeMs !== r.mtimeMs
+    })
+  }
+
   /**
    * Restore a tree-form entry: its files copied (or cloned) out one by
    * one where the outputs are absent, as on every restore after a clean. Anything else (a tree to
@@ -2114,11 +2400,13 @@ export class Cache implements CacheLayer {
   private async restoreTree(
     hash: string,
     tree: string,
+    treeIno: number,
     rows: readonly OutputFileRow[],
     projectDir: string,
     workspaceRoot: string | undefined,
     verify: (provided: ReadonlySet<string>) => void,
     accept: ((name: string) => boolean) | undefined,
+    dated: Map<string, number>,
   ): Promise<void> {
     const files = rows.filter((r) => !r.path.endsWith('/') && r.mode !== LINK_MODE)
     let bytes = 0
@@ -2129,7 +2417,20 @@ export class Cache implements CacheLayer {
         `its outputs hold ${formatBytes(bytes)}, past the ${formatBytes(this.artifactCeiling)} artifact ceiling`,
       )
     }
-    if (await this.copyTree(hash, tree, rows, files, projectDir, accept)) return
+    if (
+      await this.copyTree(
+        hash,
+        tree,
+        treeIno,
+        rows,
+        files,
+        projectDir,
+        workspaceRoot,
+        accept,
+        dated,
+      )
+    )
+      return
     await extractArtifactStream(
       packArtifactStream(this.treePlan(hash, tree, rows)),
       projectDir,
@@ -2137,6 +2438,8 @@ export class Cache implements CacheLayer {
       verify,
       accept,
       workspaceRoot,
+      undefined,
+      dated,
     )
   }
 
@@ -2171,15 +2474,23 @@ export class Cache implements CacheLayer {
    * and every directory on the way either is a real directory or is absent
    * and made here. solid's build outputs `store/dist/**` beside the sources
    * in `store/`; asking that each output's TOP be absent sent every such
-   * restore through the tar extractor, ~25 ms a task (2026-10-22).
+   * restore through the tar extractor, ~25 ms a task (2026-10-22). The
+   * files of each absent top directory are copied into the workspace's
+   * `.vx/tmp/` (`copyStaging`) and the directory renamed in once, so a
+   * reader finds it complete or not at all; one staging cannot rename into
+   * as a write in place would land (another filesystem, a setgid
+   * directory) is the extractor's.
    */
   private async copyTree(
     hash: string,
     tree: string,
+    ino: number,
     rows: readonly OutputFileRow[],
     files: readonly OutputFileRow[],
     projectDir: string,
+    workspaceRoot: string | undefined,
     accept: ((name: string) => boolean) | undefined,
+    dated: Map<string, number>,
   ): Promise<boolean> {
     for (const r of rows) {
       if (r.path.startsWith(WORKSPACE_OUTPUT_PREFIX) || r.mode === LINK_MODE) return false
@@ -2188,14 +2499,19 @@ export class Cache implements CacheLayer {
     }
     // What stands at each path, asked once: a real directory, nothing, or
     // anything else (a file, a link), which the extractor's rules decide.
-    const standing = new Map<string, Promise<'dir' | 'absent' | 'other'>>()
-    const at = (rel: string): Promise<'dir' | 'absent' | 'other'> => {
+    // Synchronous: the walk before this one looked these paths up, so each
+    // answer is a cached dentry, and the async form cost a 1,600-restore run
+    // ~40 ms of its main thread in promises (2026-11-07).
+    const standing = new Map<string, 'dir' | 'absent' | 'other'>()
+    const at = (rel: string): 'dir' | 'absent' | 'other' => {
       let known = standing.get(rel)
       if (known === undefined) {
-        known = lstat(path.join(projectDir, rel)).then(
-          (st) => (st.isDirectory() ? 'dir' : 'other'),
-          (err: NodeJS.ErrnoException) => (err.code === 'ENOENT' ? 'absent' : 'other'),
-        )
+        try {
+          const st = lstatSync(path.join(projectDir, rel), { throwIfNoEntry: false })
+          known = st === undefined ? 'absent' : st.isDirectory() ? 'dir' : 'other'
+        } catch {
+          known = 'other'
+        }
         standing.set(rel, known)
       }
       return known
@@ -2204,24 +2520,22 @@ export class Cache implements CacheLayer {
     // writes into a directory that stood: what a failure removes, and only that.
     const made = new Set<string>()
     const placed: string[] = []
-    const fits = await Promise.all(
-      rows.map(async (r) => {
-        const segs = r.path.replace(/\/$/, '').split('/')
-        for (let i = 1; i <= segs.length; i++) {
-          const rel = segs.slice(0, i).join('/')
-          const isLeaf = i === segs.length
-          const state = await at(rel)
-          if (state === 'absent') {
-            if (!isLeaf || r.path.endsWith('/')) made.add(rel)
-            else placed.push(rel)
-            return true
-          }
-          if (state === 'other' || (isLeaf && !r.path.endsWith('/'))) return false
+    const fits = rows.every((r) => {
+      const segs = r.path.replace(/\/$/, '').split('/')
+      for (let i = 1; i <= segs.length; i++) {
+        const rel = segs.slice(0, i).join('/')
+        const isLeaf = i === segs.length
+        const state = at(rel)
+        if (state === 'absent') {
+          if (!isLeaf || r.path.endsWith('/')) made.add(rel)
+          else placed.push(rel)
+          return true
         }
-        return true
-      }),
-    )
-    if (fits.includes(false)) return false
+        if (state === 'other' || (isLeaf && !r.path.endsWith('/'))) return false
+      }
+      return true
+    })
+    if (!fits) return false
     // A directory made under another one made here is the outer one's.
     const roots = [...made].filter((d) => ![...made].some((o) => d.startsWith(`${o}/`)))
     readUmask()
@@ -2229,8 +2543,8 @@ export class Cache implements CacheLayer {
     // Another process's re-save of this key renames the tree aside and a
     // new one in mid-copy: the files copied after came from another build.
     // A changed inode is that race, a miss (the task runs), and the entry
-    // the other process saved is kept.
-    const ino = lstatSync(tree).ino
+    // the other process saved is kept. `ino` is the tree's as the restore
+    // found it, before this walk: a swap since is caught all the same.
     const swapped = (): boolean => lstatSync(tree, { throwIfNoEntry: false })?.ino !== ino
     // A standing directory of this user's that withholds its own write (a
     // task's `chmod 555 dist/ro`) gets owner write and search for the copy
@@ -2246,6 +2560,46 @@ export class Cache implements CacheLayer {
       chmodSync(dir, (st.mode & 0o7777) | 0o300)
       return true
     }
+    // A missing top directory is built whole in staging and renamed in
+    // once, as the extractor does: copied in place, a reader met its files
+    // empty, then short. A file missing from a directory that stands is
+    // copied straight to its place: a temp renamed in cost such a restore
+    // a fifth to a third more (tmpfs, 3,000 files, 2026-11-06).
+    if (roots.length === 0 && placed.length === 0) return true
+    // A restore into a project directory not there yet makes it, as the
+    // copy in place did.
+    // Its stat also answers, below, what a rename into it keeps.
+    let projectStat: Stats | undefined
+    try {
+      projectStat = statSync(projectDir, { throwIfNoEntry: false })
+    } catch {
+      projectStat = undefined
+    }
+    if (projectStat === undefined) await mkdir(projectDir, { recursive: true })
+    const staging = roots.length > 0 ? await copyStaging(workspaceRoot) : undefined
+    if (staging?.stats !== undefined) {
+      const fits = new Map<string, boolean>()
+      for (const rel of roots) {
+        const dir = path.dirname(path.join(projectDir, rel))
+        let fit = fits.get(dir)
+        if (fit === undefined) {
+          const top = !rel.includes('/') && projectStat !== undefined
+          fit = stagesInto(
+            staging.stats,
+            top ? projectStat : statSync(dir, { throwIfNoEntry: false }),
+          )
+          fits.set(dir, fit)
+        }
+        if (!fit) return false
+      }
+    }
+    const temps = new Map(roots.map((rel) => [rel, staging!.temp(path.join(projectDir, rel))]))
+    const target = (rel: string): string => {
+      for (const d of roots) {
+        if (rel === d || rel.startsWith(`${d}/`)) return temps.get(d)! + rel.slice(d.length)
+      }
+      return path.join(projectDir, rel)
+    }
     const copy = async (to: string, from: string): Promise<number> => {
       try {
         return await Bun.write(to, Bun.file(from), { createPath: false })
@@ -2254,29 +2608,49 @@ export class Cache implements CacheLayer {
         return await Bun.write(to, Bun.file(from), { createPath: false })
       }
     }
+    const landed: string[] = []
+    let landing = false
+    // Every file here is written, so each is dated now (see `dated`).
+    const now = Date.now()
+    const nowDate = new Date(now)
     try {
       const dirs = new Set<string>()
       for (const r of rows) {
-        dirs.add(path.join(projectDir, r.path.endsWith('/') ? r.path : path.dirname(r.path)))
+        dirs.add(target(r.path.endsWith('/') ? r.path.slice(0, -1) : path.posix.dirname(r.path)))
       }
       for (const d of dirs) await mkdir(d, { recursive: true })
-      await Promise.all(
+      // Every copy settles before a failure is handled: one still in flight
+      // would write its file again after the cleanup removed it.
+      const copied = await Promise.allSettled(
         files.map(async (r) => {
-          const to = path.join(projectDir, r.path)
+          const to = target(r.path)
           const n = await copy(to, path.join(tree, treeName(r.path)))
           if (n !== r.size)
             throw new CorruptArtifactError(hash, `${r.path} holds ${n} bytes, recorded ${r.size}`)
           const mode = restoredMode(r.mode)
           if (mode !== plain) await chmod(to, mode)
-          const at = new Date(r.mtimeMs)
-          await utimes(to, at, at)
+          await utimes(to, nowDate, nowDate)
+          dated.set(`outputs/${r.path}`, now)
         }),
       )
+      const failed = copied.find((c) => c.status === 'rejected')
+      if (failed !== undefined) throw failed.reason
       if (swapped()) throw new ArtifactVanishedError(hash)
+      landing = true
+      for (const rel of roots) {
+        await rename(temps.get(rel)!, path.join(projectDir, rel))
+        landed.push(rel)
+      }
     } catch (err) {
+      await Promise.all([...temps.values()].map((t) => rm(t, { recursive: true, force: true })))
+      // Something made at a missing directory's place since the walk: what
+      // landed holds the entry's bytes, and the extractor restores the rest.
+      const code = landing ? (err as NodeJS.ErrnoException).code : undefined
+      if (code === 'EEXIST' || code === 'ENOTEMPTY' || code === 'EISDIR' || code === 'ENOTDIR')
+        return false
       await Promise.all([
-        ...roots.map((d) => rm(path.join(projectDir, d), { recursive: true, force: true })),
-        ...placed.map((f) => rm(path.join(projectDir, f), { force: true })),
+        ...landed.map((rel) => rm(path.join(projectDir, rel), { recursive: true, force: true })),
+        ...placed.map((rel) => rm(path.join(projectDir, rel), { force: true })),
       ])
       if (!(err instanceof ArtifactVanishedError) && swapped())
         throw new ArtifactVanishedError(hash)
@@ -2294,28 +2668,45 @@ export class Cache implements CacheLayer {
   }
 
   private stdoutText(hash: string): string {
-    const row = this.db.query('SELECT stdout FROM entry_stdout WHERE hash = ?').get(hash) as {
-      stdout: string | Uint8Array
-    } | null
-    if (row === null) return ''
-    return typeof row.stdout === 'string' ? row.stdout : utf8Decode.decode(row.stdout)
+    const row = this.selectStdout.get(hash) as { stdout: Uint8Array } | null
+    return storedLog(row?.stdout ?? null)
   }
 
-  /** Remove one entry: its artifact first, then its rows (as `prune` orders them). */
-  private async dropEntry(hash: string): Promise<void> {
-    await rm(this.tarPath(hash), { force: true })
-    await rm(this.treePath(hash), { recursive: true, force: true })
+  /**
+   * Remove one entry while its rows are still `rows`: false, touching
+   * nothing, once another process re-saved the key. Checked and dropped
+   * under the write lock a save renames its artifact in under, so no save
+   * lands between; the artifact is moved aside inside, unlinked after.
+   */
+  private async dropUnchanged(hash: string, rows: readonly OutputFileRow[]): Promise<boolean> {
+    const aside: string[] = []
     const drop = this.db.transaction(() => {
+      if (this.entryChanged(hash, rows)) return false
+      for (const [from, to] of [
+        [this.tarPath(hash), this.tempPath(hash)],
+        [this.treePath(hash), this.tempTreePath(hash)],
+      ] as const) {
+        try {
+          renameSync(from, to)
+          aside.push(to)
+        } catch (err) {
+          if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err
+        }
+      }
       this.deleteBlob.run(hash)
       this.deleteEntryRow.run(hash)
       this.outputs.forget([hash])
+      return true
     })
+    let dropped: boolean
     try {
-      drop()
+      dropped = drop.immediate()
     } catch (err) {
       if (!isIndexFull(err)) throw err
-      drop()
+      dropped = drop.immediate()
     }
+    for (const a of aside) await rm(a, { recursive: true, force: true })
+    return dropped
   }
 
   private async restoreOutputsOnce(
@@ -2323,6 +2714,8 @@ export class Cache implements CacheLayer {
     projectDir: string,
     workspaceRoot: string | undefined,
     outputs: DeclaredOutputs | undefined,
+    used: { rows: readonly OutputFileRow[] },
+    fresh: boolean,
   ): Promise<void> {
     // In-process extraction — no fork+exec on the hot path
     // (~5-10ms reclaimed per hit vs the prior subprocess `tar -xf`).
@@ -2366,24 +2759,56 @@ export class Cache implements CacheLayer {
     // in one commit, and two reads could pair its rows with the old bytes.
     // The probe's held rows (X-162) serve only while the blob carries the
     // `at` the probe saw: a re-save or a renewal since moves it, and then
-    // the rows are read again in the blob's snapshot.
+    // the rows are read again in the blob's snapshot. A file artifact's
+    // re-save is caught after, by its rows (`restoreOutputs`).
     let rows: readonly OutputFileRow[] = []
     let inline: Uint8Array | undefined
-    this.guard(() =>
-      this.db.transaction(() => {
-        const blob = this.selectBlob.get(hash) as { at: number; bytes: Uint8Array } | null
-        inline = blob?.bytes
-        rows =
-          blob === null || blob.at === this.heldInlineAt.get(hash)
-            ? this.outputs.rowsOf(hash)
-            : (this.outputs.loadOutputFilesBatch([hash]).get(hash) ?? [])
-      })(),
-    )
+    // With the probe's rows held, no transaction: a file artifact's tree,
+    // standing now, is the live one, read with no statement (an inline save
+    // moves the tree aside in the commit that adds its blob, and one moved
+    // aside mid-copy is the race `copyTree` catches); an inline one is the
+    // blob read alone, its own snapshot. The blob read and its transaction
+    // cost a 1,600-restore run ~70 ms of its main thread (2026-11-07).
+    const held = fresh ? undefined : this.outputs.heldRowsOf(hash)
+    const heldAt = this.heldInlineAt.get(hash)
+    let treeIno: number | undefined
+    let treeAsked = false
+    if (held !== undefined && heldAt === undefined) {
+      treeIno = lstatSync(this.treePath(hash), { throwIfNoEntry: false })?.ino
+      treeAsked = true
+      if (treeIno !== undefined) rows = held
+    } else if (held !== undefined) {
+      const blob = this.guard(() => this.selectBlob.get(hash)) as {
+        at: number
+        bytes: Uint8Array
+      } | null
+      if (blob?.at === heldAt) {
+        inline = blob!.bytes
+        rows = held
+      }
+    }
+    if (treeIno === undefined && inline === undefined) {
+      this.guard(() =>
+        this.db.transaction(() => {
+          const blob = this.selectBlob.get(hash) as { at: number; bytes: Uint8Array } | null
+          inline = blob?.bytes
+          rows =
+            !fresh && (blob === null || blob.at === this.heldInlineAt.get(hash))
+              ? this.outputs.rowsOf(hash)
+              : (this.outputs.loadOutputFilesBatch([hash]).get(hash) ?? [])
+        })(),
+      )
+      // A tree asked of above and absent: the artifact is the blob or the
+      // tar, and a tree saved since is a miss at worst (the tar is gone).
+      if (inline === undefined && !treeAsked)
+        treeIno = lstatSync(this.treePath(hash), { throwIfNoEntry: false })?.ino
+    }
+    used.rows = rows
     const expected = rows
       .filter((r) => workspaceRoot !== undefined || !r.path.startsWith(WORKSPACE_OUTPUT_PREFIX))
       .map((r) => (r.path.startsWith(WORKSPACE_OUTPUT_PREFIX) ? r.path : `outputs/${r.path}`))
     endRows()
-    const moded = absentModedDirs(rows, projectDir, workspaceRoot)
+    const moded = modedDirs(rows, projectDir, workspaceRoot)
     const verify = (provided: ReadonlySet<string>): void => {
       const missing = expected.filter((name) => !provided.has(name))
       if (missing.length > 0) {
@@ -2403,8 +2828,8 @@ export class Cache implements CacheLayer {
     // when every artifact is a one-file `dist/` (measured: 390 vs 355 ms
     // per 1 000). The local artifact was validated at ingest, so a missing
     // declared size is allowed; the output ceiling applies to both.
-    const tree =
-      inline === undefined && existsSync(this.treePath(hash)) ? this.treePath(hash) : undefined
+    const tree = treeIno === undefined ? undefined : this.treePath(hash)
+    const written = new Map<string, number>()
     const endExtract = span('restore: extract')
     try {
       // Every step here is an async filesystem call on purpose: a
@@ -2414,11 +2839,38 @@ export class Cache implements CacheLayer {
       // the other three (1,000-project restore row 1.1–1.2 s → 1.5 s).
       const accept = outputs === undefined ? undefined : declaredName(outputs)
       if (tree !== undefined) {
-        await this.restoreTree(hash, tree, rows, projectDir, workspaceRoot, verify, accept)
+        await this.restoreTree(
+          hash,
+          tree,
+          treeIno!,
+          rows,
+          projectDir,
+          workspaceRoot,
+          verify,
+          accept,
+          written,
+        )
       } else {
         const tar = await decodedTar(inline ?? Bun.file(src), hash, this.artifactCeiling)
-        await extractArtifactStream(tar, projectDir, workspaceRoot, verify, accept, workspaceRoot)
+        await extractArtifactStream(
+          tar,
+          projectDir,
+          workspaceRoot,
+          verify,
+          accept,
+          workspaceRoot,
+          undefined,
+          written,
+        )
       }
+      // Keyed by row path: a project output's row drops the `outputs/`.
+      const byRow = new Map<string, number>()
+      for (const [name, t] of written)
+        byRow.set(
+          name.startsWith(WORKSPACE_OUTPUT_PREFIX) ? name : name.slice('outputs/'.length),
+          t,
+        )
+      this.datedMtimes.set(hash, byRow)
       for (const [dir, mode] of moded) await chmod(dir, restoredMode(mode))
     } catch (err) {
       // A UserError here is the extractor naming the tree's fault (an
@@ -2457,7 +2909,7 @@ export class Cache implements CacheLayer {
             ? 'a directory stands where the entry holds a file'
             : 'a file stands where the entry needs a directory'
         throw new UserError(
-          `restore of ${hash} into ${projectDir} was blocked by what is on disk (${msg.startsWith(code) ? msg : `${code}: ${msg}`}): ${what}. ` +
+          `restore of ${hash} into ${projectDir} was blocked by what is on disk (${codeFirst(code, msg)}): ${what}. ` +
             `A restore replaces what the output globs select, not this — remove it and re-run.`,
         )
       }
@@ -2483,7 +2935,7 @@ export class Cache implements CacheLayer {
         (err.path === src || (tree !== undefined && inTree(err.path, tree)))
       ) {
         throw new UserError(
-          `restore of ${hash} could not read its artifact (${code}: ${err.message}). ` +
+          `restore of ${hash} could not read its artifact (${codeFirst(code, err.message)}). ` +
             `Make the cache directory readable by this user, or point cacheDir / --cache-dir at one that is.`,
         )
       }
@@ -2492,7 +2944,7 @@ export class Cache implements CacheLayer {
           ? 'Free space on that disk and re-run.'
           : 'Make the declared output paths writable by this user, or stop declaring them as outputs.'
         throw new UserError(
-          `restore of ${hash} into ${projectDir} could not write its outputs (${code}: ${err.message}). ${remedy}`,
+          `restore of ${hash} into ${projectDir} could not write its outputs (${codeFirst(code, err.message)}). ${remedy}`,
         )
       }
       // The process is out of descriptors: the artifact is fine, and
@@ -2507,14 +2959,20 @@ export class Cache implements CacheLayer {
       if (code === 'ENOENT' && (err as NodeJS.ErrnoException).path === src) {
         throw new ArtifactVanishedError(hash)
       }
-      // So is a tree file: a prune or another process's re-save moved the
-      // tree aside mid-copy.
-      if (
-        code === 'ENOENT' &&
-        tree !== undefined &&
-        inTree((err as NodeJS.ErrnoException).path, tree)
-      ) {
-        throw new ArtifactVanishedError(hash)
+      // So is a tree a prune or another process's re-save moved aside
+      // mid-copy. The tree the restore found, still in place, lacking a
+      // file is damage at rest (a hand-deleted file): called vanished "(a
+      // vx cache clean)" that never ran, and kept, so the demoted task's
+      // own probe hit it again and said so twice.
+      const missing = (err as NodeJS.ErrnoException).path
+      if (code === 'ENOENT' && tree !== undefined && inTree(missing, tree)) {
+        if (lstatSync(tree, { throwIfNoEntry: false })?.ino !== treeIno)
+          throw new ArtifactVanishedError(hash)
+        const rel = path.relative(tree, missing!).split(path.sep).join('/')
+        throw new CorruptArtifactError(
+          hash,
+          `${rel.startsWith('outputs/') ? rel.slice('outputs/'.length) : rel} is missing from its stored tree`,
+        )
       }
       // A staged file the restore itself just wrote is gone before its
       // commit: another process cleaned the same outputs under us (two runs
@@ -2556,7 +3014,8 @@ export class Cache implements CacheLayer {
    * returns says so; an empty one has nothing to serve and refuses.
    */
   readOnlyNotice(): string | null {
-    if (this.writeBlocked === null) return null
+    // A reading handle over no index: nothing was refused it.
+    if (this.writeBlocked === null || this.writeBlocked === NO_INDEX) return null
     if (this.empty) this.assertWritable()
     return (
       `cache directory ${this.cacheDir} is not writable (${this.writeBlocked}) — serving hits ` +
@@ -2605,6 +3064,7 @@ export class Cache implements CacheLayer {
         args.hash,
         rows.reduce((n, r) => n + r.size, 0),
       )
+      this.keptHashes.add(args.hash)
       return
     }
     // The cache directory is the constructor's (`mkdirSync`, with a
@@ -2851,7 +3311,7 @@ export class Cache implements CacheLayer {
     if (plan.size > this.artifactCeiling) {
       throw new Error(
         `${args.entry.taskId} is not cached: its outputs pack to ${formatBytes(plan.size)}, past the ` +
-          `${formatBytes(this.artifactCeiling)} artifact ceiling a restore enforces — narrow cache.outputs.files`,
+          `${formatBytes(this.artifactCeiling)} artifact ceiling a restore enforces — narrow outputs.files`,
       )
     }
     return plan
@@ -3154,7 +3614,10 @@ export class Cache implements CacheLayer {
         Bun.hash.crc32(bytes),
       ])
     }
-    const stdoutText = scanned.stdout
+    // Compressed before the write lock is taken: logs are most of what the
+    // index held as text (v52).
+    const stdoutBlob =
+      scanned.stdout === '' ? null : await zstdCompress(utf8.encode(scanned.stdout))
 
     const [project, task] = splitTaskId(meta.taskId)
     const now = Date.now()
@@ -3251,15 +3714,10 @@ export class Cache implements CacheLayer {
         // packed, an ingest what the producing machine packed.
         scanned.exec?.cpuMs ?? null,
         scanned.exec?.peakRssBytes ?? null,
+        this.runId ?? null,
       )
-      if (stdoutText === '') deleteStdout.run(hash)
-      // bun:sqlite drops a leading U+FEFF from a bound string; its UTF-8
-      // bytes, cast to TEXT, keep it.
-      else
-        upsertStdout.run(
-          hash,
-          stdoutText.startsWith('\uFEFF') ? utf8.encode(stdoutText) : stdoutText,
-        )
+      if (stdoutBlob === null) deleteStdout.run(hash)
+      else upsertStdout.run(hash, stdoutBlob)
       outputBytes = outputs.replaceFileRows(hash, outputFileRows)
       // INSERT OR IGNORE: identical inputs derive this same hash, so a
       // re-save's row is identical — keep the first, skip the rest.
@@ -3332,9 +3790,36 @@ export class Cache implements CacheLayer {
       for (let i = 0; i < batch.length; i++) batch[i]!.settle(failed.get(i) ?? err)
       return
     }
+    if (this.checkpoints === 'armed') this.startCheckpointer()
     for (let i = 0; i < batch.length; i++) batch[i]!.settle(failed.get(i))
   }
 
+  /**
+   * A run's saves from now on leave the WAL's checkpoints to a thread of
+   * their own (checkpointer.ts), started by the first save's commit, so a
+   * run that saves nothing starts none. `stopCheckpoints` ends it.
+   */
+  checkpointOffThread(): void {
+    if (this.checkpoints === undefined && historyFiles(this) !== undefined)
+      this.checkpoints = 'armed'
+  }
+
+  private startCheckpointer(): void {
+    const files = historyFiles(this)!
+    this.db.exec('PRAGMA wal_autocheckpoint = 0')
+    this.checkpoints = new WalCheckpointer(files, () => {
+      // No thread: the run's connection checkpoints as it did.
+      this.db.exec(`PRAGMA wal_autocheckpoint = ${WAL_AUTOCHECKPOINT}`)
+    })
+  }
+
+  /** Ends the checkpoint thread before `close`, so this connection's close is the last. */
+  async stopCheckpoints(): Promise<void> {
+    const c = this.checkpoints
+    this.checkpoints = undefined
+    if (c instanceof WalCheckpointer) await c.stop()
+  }
+
   private tempTreePath(hash: string): string {
     return `${this.treePath(hash)}.tmp-${process.pid}-${process.hrtime.bigint()}-${Math.random().toString(36).slice(2, 10)}`
   }
@@ -3386,9 +3871,12 @@ export class Cache implements CacheLayer {
     if (this.writeBlocked !== null) return
     return this.guard(() => this.history.recordRun(run))
   }
-  recordRuns(runs: readonly RunRecord[]): void {
+  recordRuns(
+    runs: readonly RunRecord[],
+    head?: Pick<InvocationRecord, 'branch' | 'commitSha'>,
+  ): void {
     if (this.writeBlocked !== null) return
-    return this.guard(() => this.history.recordRuns(runs))
+    return this.guard(() => this.history.recordRuns(runs, head))
   }
   recordRunBundle(bundle: { runs: readonly RunRecord[]; invocation: InvocationRecord }): void {
     if (this.writeBlocked !== null) return
@@ -3418,7 +3906,7 @@ export class Cache implements CacheLayer {
     const since = Date.now() - 24 * 60 * 60 * 1000
     const runs = this.db
       .prepare(
-        `SELECT COUNT(*) AS total, COALESCE(SUM(CASE WHEN status IN ('cache-hit', 'cache-hit-remote') THEN 1 ELSE 0 END), 0) AS hits, COALESCE(SUM(restored = 1), 0) AS restored FROM runs WHERE started_at >= ? AND ${EXECUTED_RUNS_SQL}${
+        `SELECT COUNT(*) AS total, COALESCE(SUM(CASE WHEN status IN ('cache-hit', 'cache-hit-remote') THEN 1 ELSE 0 END), 0) AS hits, COALESCE(SUM(restored = 1), 0) AS restored FROM main.runs WHERE started_at >= ? AND ${EXECUTED_RUNS_SQL}${
           scoped ? ' AND project = ?' : ''
         }`,
       )
@@ -3536,7 +4024,12 @@ export class Cache implements CacheLayer {
         freelist_count: number
       }
       if (free === 0) return
-      this.db.exec(`VACUUM ${schema}`)
+      this.db.exec('DROP VIEW IF EXISTS temp.runs')
+      try {
+        this.db.exec(`VACUUM ${schema}`)
+      } finally {
+        this.db.exec(RUNS_VIEW)
+      }
       this.db.exec(`PRAGMA ${schema}.wal_checkpoint(TRUNCATE)`)
     } catch {
       // Another process holds the database, or the disk has no room for the copy.
@@ -3688,10 +4181,16 @@ export class Cache implements CacheLayer {
     try {
       this.flushIndex()
       clearTimeout(this.heldTimer)
-      const held = this.heldBlobSizes ?? (this.heldTimer !== undefined ? this.heldRest() : [])
+      const held =
+        this.heldBlobSizes !== undefined
+          ? new Map(this.heldBlobSizes)
+          : this.storing !== undefined
+            ? this.heldSizes(this.storing, this.stored, this.storing.length)
+            : undefined
       this.heldBlobSizes = undefined
+      this.storing = undefined
       this.heldTimer = undefined
-      if (held.length > 0) this.files.rememberBlobSizes(new Map(held))
+      if (held !== undefined && held.size > 0) this.files.rememberBlobSizes(held)
       this.flushAccessed()
       this.outputs.flushOutputDirs()
       this.folds.flush()
@@ -3704,6 +4203,8 @@ export class Cache implements CacheLayer {
       // `rm -rf .vx/cache`): macOS answers SQLITE_IOERR_VNODE on a
       // write to an unlinked file where Linux happily writes on.
     }
+    if (this.checkpoints instanceof WalCheckpointer) this.checkpoints.terminate()
+    this.checkpoints = undefined
     closeDb(this.db)
   }
 
@@ -3727,8 +4228,16 @@ export class Cache implements CacheLayer {
   }
 }
 
-/** SQLite's file-control opcode (sqlite3.h). */
-export const SQLITE_FCNTL_PERSIST_WAL = 10
+/**
+ * The files a second connection writes a run's hits through
+ * (history-stream.ts); undefined when the store keeps no history on disk.
+ * A function, as `indexDb` is: no plugin writes the history.
+ */
+export function historyFiles(cache: Cache): { index: string; store?: string } | undefined {
+  if (cache['empty'] || cache['writeBlocked'] !== null || cache['inspecting']) return undefined
+  if (cache.storeDir === undefined) return { index: cache['dbFile'] }
+  return { index: cache['dbFile'], store: path.join(cache.storeDir, 'store.db') }
+}
 
 /**
  * The cache's `bun:sqlite` handle, for core's own readers (`vx last`, `vx
@@ -3759,6 +4268,131 @@ export function closeDb(db: Database): void {
   }
 }
 
+/**
+ * Wait until no other connection has the shared store in `storeDir` open,
+ * then hold it alone until the release. Every checkout of a repository
+ * shares its store and each has a run lock of its own, so a clean in one
+ * deleted store.db under a run in another. A run holds the store open from
+ * its run lock to its end (never while it waits for that lock, which a
+ * clean holds while it waits here), and in WAL mode every open connection keeps a
+ * shared lock on the file: SQLite grants an exclusive one only to a sole
+ * holder, and a holder's lock dies with its process. The run path pays
+ * nothing. Holds nothing where the store has no readable file.
+ */
+export async function holdStore(
+  storeDir: string,
+  log: (line: string) => void,
+): Promise<() => void> {
+  const file = path.join(storeDir, 'store.db')
+  if (!existsSync(file)) return () => {}
+  let db: Database
+  try {
+    db = new Database(file)
+    db.exec('PRAGMA busy_timeout = 0')
+    db.exec('PRAGMA locking_mode = EXCLUSIVE')
+  } catch {
+    return () => {}
+  }
+  const started = performance.now()
+  let said = false
+  for (;;) {
+    try {
+      db.exec('BEGIN EXCLUSIVE')
+      break
+    } catch (err) {
+      if ((err as { code?: string }).code !== 'SQLITE_BUSY') {
+        // Not a store SQLite reads: nothing opens it to wait for.
+        closeDb(db)
+        return () => {}
+      }
+    }
+    if (!said && performance.now() - started >= 1_000) {
+      said = true
+      log(`[vx] waiting for another vx process using the cache store ${storeDir} to finish…`)
+    }
+    await Bun.sleep(50)
+  }
+  return () => closeDb(db)
+}
+
+/** The file in a cache directory with no store that its runs hold shared and a clean alone (`holdCacheDir`). */
+const DIR_LOCK = 'cache.lock'
+
+/**
+ * Hold a cache directory with no store — `--cache-dir`, `cache.dir`,
+ * `VX_CACHE_DIR`, which workspaces may share — `shared` for a run, from
+ * before its cache opens to its close, or `exclusive` for `vx cache clean`,
+ * waiting for the other side. Each workspace's run lock is its own, and
+ * `holdStore` waits only on a store.db, so a clean in one workspace deleted
+ * the directory under a run of another opening it (ENOENT on its
+ * `.gitignore`, SQLite's disk I/O error). The lock is SQLite's on
+ * `cache.lock` in the directory: shared and exclusive, any spelling of the
+ * directory meets it, and a holder's lock dies with its process. A clean
+ * deletes the file with the rest while it holds it, so a taker checks the
+ * name still is the file it locked. A directory with no index yet, or one
+ * this user cannot write, holds nothing: there is nothing a clean deletes.
+ * A default directory beside its store pays nothing.
+ */
+export async function holdCacheDir(
+  dir: string,
+  mode: 'shared' | 'exclusive',
+  log: (line: string) => void,
+  signal?: AbortSignal,
+): Promise<() => void> {
+  const file = path.join(dir, DIR_LOCK)
+  const started = performance.now()
+  let said = false
+  for (;;) {
+    if (signal?.aborted === true) return () => {}
+    let db: Database
+    let before: Stats
+    try {
+      let seen = statSync(file, { throwIfNoEntry: false })
+      if (seen === undefined) {
+        // A directory with no index has nothing a clean deletes, and may be
+        // one a first index is refused in (a project's own): nothing is
+        // written there.
+        if (!existsSync(path.join(dir, 'cache.db'))) return () => {}
+        // Made before it is stat'ed: a file Database creates is not the one
+        // a stat before it saw.
+        writeFileSync(file, '', { flag: 'a' })
+        seen = statSync(file)
+      }
+      before = seen
+      db = new Database(file)
+      db.exec('PRAGMA busy_timeout = 0')
+    } catch {
+      return () => {}
+    }
+    try {
+      if (mode === 'exclusive') db.exec('BEGIN EXCLUSIVE')
+      else {
+        db.exec('BEGIN')
+        db.query('SELECT count(*) FROM sqlite_master').get()
+      }
+      const now = statSync(file, { throwIfNoEntry: false })
+      if (now !== undefined && now.ino === before.ino && now.dev === before.dev) {
+        return () => closeDb(db)
+      }
+      // A clean deleted it while this waited: take the one there now.
+      closeDb(db)
+      continue
+    } catch (err) {
+      closeDb(db)
+      if ((err as { code?: string }).code !== 'SQLITE_BUSY') return () => {}
+    }
+    if (!said && performance.now() - started >= 1_000) {
+      said = true
+      log(
+        mode === 'exclusive'
+          ? `[vx] waiting for another vx process using the cache directory ${dir} to finish…`
+          : `[vx] waiting for a vx cache clean of ${dir} to finish…`,
+      )
+    }
+    await Bun.sleep(50)
+  }
+}
+
 /**
  * Refuse an artifact whose file names no restore can materialise as one
  * tree, or (given the task's declared outputs) that names a file outside
@@ -3805,12 +4439,14 @@ function assertArtifactNames(
 
 /**
  * The directories with a mode to restore (`DIR_MODE` rows) that are absent
- * before the restore, deepest first: the restore makes them with mkdir's
- * default, and each is then given the mode the miss left, minus the umask
- * as a file's is. One that stands is the tree's, left as it is. A mode
- * only ever narrows mkdir's default, whatever an artifact says.
+ * before the restore, or stand with another mode, deepest first: the
+ * restore makes a missing one with mkdir's default, and each is then given
+ * the mode the miss left, minus the umask as a file's is. A standing one
+ * kept its own mode once, so a branch switch A → B → A left B's 0755 on
+ * A's `chmod 700 dist/keys`. A symlink is never followed. A mode only ever
+ * narrows mkdir's default, whatever an artifact says.
  */
-function absentModedDirs(
+function modedDirs(
   rows: readonly OutputFileRow[],
   projectDir: string,
   workspaceRoot: string | undefined,
@@ -3824,7 +4460,9 @@ function absentModedDirs(
     const dir = ws
       ? path.join(workspaceRoot!, rel.slice(WORKSPACE_OUTPUT_PREFIX.length))
       : path.join(projectDir, rel)
-    if (lstatSync(dir, { throwIfNoEntry: false }) === undefined) out.push([dir, r.mode & 0o777])
+    const st = lstatSync(dir, { throwIfNoEntry: false })
+    if (st === undefined || (st.isDirectory() && !modeMatches(st.mode, r.mode)))
+      out.push([dir, r.mode & 0o777])
   }
   return out.sort((a, b) => b[0].length - a[0].length)
 }
@@ -3834,12 +4472,26 @@ function treeName(rowPath: string): string {
   return rowPath.startsWith(WORKSPACE_OUTPUT_PREFIX) ? rowPath : `outputs/${rowPath}`
 }
 
+/** `code: message`, where Bun's message does not already open with the code. */
+function codeFirst(code: string | undefined, message: string): string {
+  return code === undefined || message.startsWith(code) ? message : `${code}: ${message}`
+}
+
 function inTree(p: string | undefined, tree: string): boolean {
   return p !== undefined && (p === tree || p.startsWith(`${tree}/`))
 }
 
 const utf8Decode = new TextDecoder('utf-8', { ignoreBOM: true })
 
+/**
+ * An `entry_stdout` row's log (v52): a zstd frame of its UTF-8, which keeps
+ * a leading U+FEFF a bound string loses. Null, no row, reads as ''. The
+ * index is vx's own, so the frame is trusted, as a tree's files are.
+ */
+export function storedLog(blob: Uint8Array | null): string {
+  return blob === null ? '' : utf8Decode.decode(Bun.zstdDecompressSync(blob))
+}
+
 /**
  * Whether an artifact entry names one of the task's declared outputs, as
  * the save could have packed it (`restorableOutput`: a `!` take-back, vx's