@vzn/vx 0.0.651 → 0.0.653

package/src/orchestrator/execute-task.ts

@@ -1,22 +1,32 @@
+import { existsSync, lstatSync } from 'node:fs'
 import path from 'node:path'
-import type { ExecConfig, TaskConfig, CacheConfig, InputStability } from '../config.js'
+import type { ExecConfig, TaskConfig, InputsConfig, InputStability } from '../config.js'
 import {
+  ABSENT_INPUT,
   ArtifactVanishedError,
   type CacheEntry,
   type CacheLayer,
   type CachePolicy,
   cleanOutputs,
+  cleanOutputPaths,
   committedFiles,
   cleanWorkspaceOutputs,
   type OutputStamp,
   ownOutputsSince,
   ownWorkspaceOutputsSince,
+  resolveOutputs,
+  resolveWorkspaceOutputs,
   stampOutputs,
   stampWorkspaceOutputs,
+  stampCommitted,
+  committedMoved,
   FULL_CACHE_POLICY,
   type GitFilesCache,
   racyWindowMs,
+  stampGrainMs,
   type TaskInputComponent,
+  declaresInput,
+  fsClockNow,
 } from '../cache/index.js'
 import {
   signalExitCode,
@@ -40,8 +50,19 @@ import {
   FAILED_OUTPUT_TAIL_CHARS,
   failedOutputLog,
 } from './output-log.js'
-import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import {
+  isGroupTask,
+  OutputsFailed,
+  RestoreDemoted,
+  RestoreFailed,
+  standInsOf,
+  type TaskNode,
+  type TaskOutcome,
+} from '../graph/index.js'
+import {
+  anyTaskGlob,
+  heldSecrets,
+  isLiteralPattern,
   killGraceMs,
   MASKED,
   maskedStreams,
@@ -49,6 +70,7 @@ import {
   printable,
   relPosix,
   secretMask,
+  type SecretMask,
   secretNamed,
   span,
   UserError,
@@ -58,6 +80,7 @@ import { executorLabel, nameExecutorFailure } from './plugin-host.js'
 import type { CommandWindows } from './command-windows.js'
 import {
   commandWriteReach,
+  dependencyReads,
   mayWriteFingerprint,
   type Placeholder,
   reachedWithheld,
@@ -93,6 +116,7 @@ import {
   type HashCache,
   type InputFact,
   isKeyless,
+  keyOf,
   movedInput,
   type UpfrontGroupKey,
 } from './task-hash.js'
@@ -127,6 +151,12 @@ export interface ExecuteArgs {
    * machine. The hash is still computed — dependents fold it.
    */
   remoteOnlyNoop?: boolean
+  /**
+   * The task depends on a `remoteOnlyNoop` one, directly or through others
+   * (`Placements.belowNoop`): it saves nothing, since its key names the
+   * no-op's outputs, which never landed.
+   */
+  belowNoop?: boolean
   /**
    * `exec.remote: 'only'` placed on a remote executor: execute remotely,
    * but this machine's disk is untouched — no output clean, no vx cache
@@ -146,6 +176,11 @@ export interface ExecuteArgs {
    *  where a locally-placed consumer fetches its producers from. */
   deferred?: DeferredOutputs
   nestedProjectDirs: string[]
+  /**
+   * Where its outputs stop when that is more than `nestedProjectDirs`: the
+   * nested workspaces under it too (prepare.ts `outputWallsOf`).
+   */
+  outputNestedDirs?: string[]
   /** The run's cache directory: walled off from a sandboxed task's grants. */
   cacheDir?: string
   /** Anchor for hrtime spans across all tasks in this run. */
@@ -183,17 +218,23 @@ export interface ExecuteArgs {
    * byte-identical with and without it.
    */
   retries?: number
+  /**
+   * Whether the run history knows the task as flaky (`knownFlaky`): a keyed
+   * task with no `retries` of its own or of the run that fails gets ONE more
+   * attempt when it does. Decided at run time, so never in the key.
+   */
+  knownFlaky?: (node: TaskNode, hash: string) => boolean
   /**
    * `run.timeout` (ms), already resolved from flag, variable and
    * workspace. Per-task `exec.timeout` wins. Never hashed.
    */
   timeout?: number
   /**
-   * The run's `inputStability` layers around the task's own: `run` from
+   * The run's `inputs.stability` layers around the task's own: `run` from
    * the env vars (above the task), `workspace` from `.vx/workspace` (below).
    */
   inputStability?: { run: InputStability; workspace?: InputStability }
-  /** `cache.outputs.clean` for tasks without their own: `.vx/workspace`. */
+  /** `outputs.clean` for tasks without their own: `.vx/workspace`. */
   cleanOutputs?: boolean
   /** Per-run memo for `git ls-files` (one entry per project dir). */
   gitFilesCache?: GitFilesCache
@@ -236,6 +277,17 @@ export interface ExecuteArgs {
    * granted a linked workspace package only when it is in this set.
    */
   keyedProjects: (node: TaskNode) => ReadonlySet<string>
+  /**
+   * The run's lookup of the tasks whose outputs a sandboxed task may read
+   * (keyed-projects.ts `readableDeps`). Absent: none.
+   */
+  readableDeps?: (node: TaskNode) => readonly TaskNode[]
+  /**
+   * The projects nested in a keyed one, by its dir (keyed-projects.ts
+   * `nestedDirsOf`): walled from a task granted that linked package.
+   * Absent: none.
+   */
+  nestedDirsOf?: (projectDir: string) => readonly string[]
   /**
    * Run-scoped list the miss path appends its output-directory snapshot
    * request to, taken at run end (run.ts) instead of right after the save:
@@ -244,7 +296,7 @@ export interface ExecuteArgs {
    */
   outputDirSnapshots?: OutputDirSnapshot[]
   /** The run's save lane: a miss's cache save runs off the execution slot (save-lane.ts). */
-  deferSave?: (save: () => Promise<void>) => Promise<boolean>
+  deferSave?: (save: () => Promise<void>, taskId: string) => Promise<boolean>
   /**
    * Where a deferred save's `landed` promise is parked by task id, for the
    * in-flight join (admission.ts): a duplicate of this task in another run
@@ -290,6 +342,26 @@ export interface ExecuteArgs {
   serversNested?: readonly (readonly string[])[]
   /** When each command of the run ran and where it may write (command-windows.ts). */
   commandWindows?: CommandWindows
+  /**
+   * A persistent task matched `readyWhen` (or spawned, with none): what it
+   * writes from here on is its since-ready output (run.ts holds it until
+   * the task's outcome has been logged).
+   */
+  serverReady?: (id: string) => void
+  /**
+   * Asked just before a miss is saved: whether a server it depends on
+   * (through groups too) died while it ran, which then holds the save. Its
+   * key is a healthy run's; its bytes were built against a dead server.
+   */
+  serverDiedUnder?: (node: TaskNode) => Promise<boolean>
+  /**
+   * Told once when an attempt's shell left a process running: it may still
+   * write the outputs a dependent reads, so run.ts seeds the run's taint
+   * with this task and nothing built on it is saved.
+   */
+  leftRunning?: (node: TaskNode) => void
+  /** A `vx watch` cycle (`RunOptions.watch`): an input edited mid-run is the next cycle's. */
+  watch?: true
 }
 
 /**
@@ -345,7 +417,7 @@ function readsCache(args: ExecuteArgs): boolean {
   const policy = args.cachePolicy ?? FULL_CACHE_POLICY
   return (
     args.remoteOnly !== true &&
-    args.node.config.cache !== undefined &&
+    args.node.config.cache === true &&
     (policy.localRead || policy.remoteRead)
   )
 }
@@ -377,7 +449,8 @@ async function restoreProbed(
  * A hit restored, or null when its artifact was removed after the probe (a
  * `vx cache clean`, here or for a workspace sharing the cache directory): a
  * miss. The restore has wiped the declared outputs by then; the run path
- * cleans them again and the task writes them.
+ * cleans them again and the task writes them. Any other throw fails the
+ * task as a failed restore (`RestoreFailed`), never as a miss.
  */
 async function restoreOrMiss(
   args: ExecuteArgs,
@@ -389,7 +462,7 @@ async function restoreOrMiss(
   try {
     return await restoreHit({ args, hash, hit, cacheOpStart, taskStartNs })
   } catch (err) {
-    if (!(err instanceof ArtifactVanishedError)) throw err
+    if (!(err instanceof ArtifactVanishedError)) throw new RestoreFailed(err)
     warnOf(args.log)(`[vx] ${args.node.id}: ${err.message} — running it`)
     return null
   }
@@ -397,16 +470,16 @@ async function restoreOrMiss(
 
 /**
  * What a write to an input during the command means, each field highest
- * first: the env var (`layers.run`), the task's `cache.inputStability`,
+ * first: the env var (`layers.run`), the task's `inputs.stability`,
  * the workspace's, then `'immutable'` and `'warn'` (2026-10-12), so
  * by default any such write withholds the save, on CI too, since a
  * concurrent task can change an input and put it back.
  */
 function inputStabilityOf(
-  cache: CacheConfig | undefined,
+  inputs: InputsConfig | undefined,
   layers: ExecuteArgs['inputStability'],
 ): Required<InputStability> {
-  const task = cache?.inputStability
+  const task = inputs?.stability
   return {
     strategy: layers?.run.strategy ?? task?.strategy ?? layers?.workspace?.strategy ?? 'immutable',
     severity: layers?.run.severity ?? task?.severity ?? layers?.workspace?.severity ?? 'warn',
@@ -444,16 +517,18 @@ async function executeGroupTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
   }
   const wallclockNs = process.hrtime.bigint() - args.runStartHrTimeNs
-  const hash = await computeTaskHash({
-    node: args.node,
-    upstream: args.upstream,
-    workspaceRoot: args.workspaceRoot,
-    cache: args.cache,
-    forwardArgs: args.forwardArgs,
-    nestedProjectDirs: args.nestedProjectDirs,
-    ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
-    ...(args.hashCache !== undefined ? { hashCache: args.hashCache } : {}),
-  })
+  const hash = await keyOf(
+    computeTaskHash({
+      node: args.node,
+      upstream: args.upstream,
+      workspaceRoot: args.workspaceRoot,
+      cache: args.cache,
+      forwardArgs: args.forwardArgs,
+      nestedProjectDirs: args.nestedProjectDirs,
+      ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
+      ...(args.hashCache !== undefined ? { hashCache: args.hashCache } : {}),
+    }),
+  )
   return groupOutcome(args.node, args.upstream, hash, wallclockNs)
 }
 
@@ -518,9 +593,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const { node, upstream, cache, log } = args
   const cfg: TaskConfig = node.config
   const step = cfg.exec as ExecConfig // dispatcher guarantees exec is present
-  const cacheCfg: CacheConfig | undefined = cfg.cache
+  const cfgOut = cfg.outputs
   const policy = args.cachePolicy ?? FULL_CACHE_POLICY
-  const cfgCacheable = cacheCfg !== undefined
+  const cfgCacheable = cfg.cache === true
   // We may READ when at least one read axis is on (the cache layer
   // refines local vs remote), and WRITE when at least one write axis is
   // on. Output management (clean before exec) keys off writes — so
@@ -535,7 +610,13 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // nothing to read under it, and nothing a later run could find.
   const present = upstream.filter((u): u is TaskOutcome => u !== undefined)
   const folded = new Set(
-    filterUpstreamHashes(present, cfg.inputs?.tasks, node.projectName, node.id).map(([id]) => id),
+    filterUpstreamHashes(
+      present,
+      cfg.inputs?.tasks,
+      node.projectName,
+      node.id,
+      standInsOf(node),
+    ).map(([id]) => id),
   )
   const foldedTasks = expandGroupUpstream(present.filter((u) => folded.has(u.node.id)))
   const keylessBy = isKeyless(cfg)
@@ -560,7 +641,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // task's unfinished deps).
   const unkeyedUpstream = foldedTasks.find((u) => u.unkeyed === true)
   let unkeyed = unkeyedUpstream !== undefined
-  const willSave = willWrite && args.taintedUpstream !== true && !unkeyed && !keyless
+  /** The input `keyStillTrue` found moved under the command (`TaskOutcome.driftedInput`). */
+  let driftedInput: string | null | undefined
+  const willSave =
+    willWrite && args.taintedUpstream !== true && !unkeyed && !keyless && args.belowNoop !== true
 
   // The executor retains nothing: the entry's output is the attempt's
   // `output` log, both streams in the order they reached the logger, kept
@@ -571,8 +655,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const deferralRequested = args.download === 'deferred'
   const capture: CaptureConfig = { stdout: false, stderr: false }
 
-  const outputs = cacheCfg?.outputs.files ?? []
-  const wsOutputs = cacheCfg?.outputs.workspaceFiles ?? []
+  const outputs = cfgOut?.files ?? []
+  const wsOutputs = cfgOut?.workspaceFiles ?? []
   const effectiveForwardArgs = node.requested ? (args.forwardArgs ?? []) : []
   // Per-task `exec.timeout` beats `run.timeout` (flag, variable,
   // workspace; resolved into `args.timeout` by run.ts).
@@ -587,6 +671,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // does an executor that declares `timeouts`.
   let timeoutTimer: ReturnType<typeof setTimeout> | undefined
   let timeoutFired = false
+  // Fail-fast withdrew the attempt while its executor still held it for a
+  // machine to begin (`running` answered `null`): it never started.
+  let unbegun = false
+  let withdrawUnbegun: (() => void) | undefined
   // The attempt's listener on the run's stop signal, taken off once the
   // attempt settles. Left on, every task of the run added one: the list
   // grew to the task count, and each add scans it for a duplicate, ~100 ms
@@ -597,12 +685,32 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     const abort = (): void => stop.abort(args.stopSignal?.reason)
     unlistenStop?.()
     unlistenStop = undefined
+    unbegun = false
+    withdrawUnbegun = undefined
     if (args.stopSignal?.aborted === true) abort()
     else if (args.stopSignal !== undefined) {
       const run = args.stopSignal
       run.addEventListener('abort', abort, { once: true })
       unlistenStop = () => run.removeEventListener('abort', abort)
     }
+    // `--continue=never` starts nothing after a failure: a task a plugin
+    // executor still holds for a machine is not yet started, and was sent
+    // to one after the failure (2026-11-06).
+    const failFast = args.failFast
+    if (!local && failFast !== undefined && args.executor.running !== undefined) {
+      const withdraw = (): void => {
+        if (stop.signal.aborted || args.executor.running?.(node.id) !== null) return
+        unbegun = true
+        stop.abort(new Error('fail-fast'))
+      }
+      withdrawUnbegun = withdraw
+      failFast.addEventListener('abort', withdraw, { once: true })
+      const unlisten = unlistenStop
+      unlistenStop = () => {
+        unlisten?.()
+        failFast.removeEventListener('abort', withdraw)
+      }
+    }
     clearTimeout(timeoutTimer)
     timeoutFired = false
     if (effectiveTimeout !== undefined && !local && args.executor.timeouts !== true) {
@@ -623,7 +731,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     signal: AbortSignal | undefined,
   ): Promise<unknown> {
     if (signal === undefined || isLocalExecutor(args.executor)) return running
-    const started = Date.now()
+    const started = performance.now()
     let graceTimer: ReturnType<typeof setTimeout> | undefined
     let onAbort: (() => void) | undefined
     const abandoned = new Promise<ExecuteResult>((resolve) => {
@@ -638,10 +746,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
           const reason: unknown = signal.reason
           resolve({
             exitCode: signalExitCode(reason === 'SIGINT' ? 'SIGINT' : 'SIGTERM'),
-            durationMs: Date.now() - started,
+            durationMs: Math.round(performance.now() - started),
             stdout: '',
             stderr: '',
             violations: [],
+            // What it started may still run and write the retry's outputs.
+            leftRunning: true,
             ...(timeoutFired ? { timedOut: true } : {}),
           })
         }, graceMs)
@@ -685,19 +795,21 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const hash =
     preProbed?.hash ??
     args.upfrontKey ??
-    (await computeTaskHash({
-      node,
-      upstream,
-      workspaceRoot: args.workspaceRoot,
-      cache,
-      forwardArgs: args.forwardArgs,
-      nestedProjectDirs: args.nestedProjectDirs,
-      ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
-      ...(args.hashCache !== undefined ? { hashCache: args.hashCache } : {}),
-      ...(args.probesAfterWrites !== undefined
-        ? { probesAfterWrites: args.probesAfterWrites }
-        : {}),
-    }))
+    (await keyOf(
+      computeTaskHash({
+        node,
+        upstream,
+        workspaceRoot: args.workspaceRoot,
+        cache,
+        forwardArgs: args.forwardArgs,
+        nestedProjectDirs: args.nestedProjectDirs,
+        ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
+        ...(args.hashCache !== undefined ? { hashCache: args.hashCache } : {}),
+        ...(args.probesAfterWrites !== undefined
+          ? { probesAfterWrites: args.probesAfterWrites }
+          : {}),
+      }),
+    ))
 
   // The local no-op half of `exec.remote: 'only'`: no remote executor took
   // the task, so it succeeds without running. The hash was still computed —
@@ -715,32 +827,48 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
   }
 
+  const ownInputs = {
+    projectDir: node.projectDir,
+    workspaceRoot: args.workspaceRoot,
+    declared: node.config.inputs,
+  }
   const cleanArgs = {
     projectDir: node.projectDir,
     outputs,
-    nestedProjectDirs: args.nestedProjectDirs,
+    nestedProjectDirs: args.outputNestedDirs ?? args.nestedProjectDirs,
+    inputs: ownInputs,
     committed: committedFiles(args.gitFilesCache, node.projectDir),
   }
   const wsCleanArgs = {
     workspaceRoot: args.workspaceRoot,
     outputs: wsOutputs,
+    inputs: ownInputs,
     committed: committedFiles(args.gitFilesCache, args.workspaceRoot),
   }
   // An ADDITIVE task (its outputs overlap an upstream's, with the edge that
   // orders them; item 588) does not clean by glob — the glob selects the
   // upstream's files it adds beside. Its outputs are stamped once before
   // the first attempt, and after a 0 exit its own set is what the run
-  // added or changed against that stamp. Stale files of its own from an
+  // added or changed against that stamp; a retry first removes what the
+  // failed attempt added (`dropFailedAdditions`). Stale files of its own from an
   // earlier run are its command's to clean, as they are under Turbo.
   const additive = (node.addsToOutputsOf?.length ?? 0) > 0
   let stampedBefore: ReadonlyMap<string, OutputStamp> | undefined
   let wsStampedBefore: ReadonlyMap<string, OutputStamp> | undefined
-  // `cache.outputs.clean: false` leaves the outputs to the first attempt's
+  // A failed attempt changed or removed a file the stamp found, or a
+  // committed file under the outputs (no clean deletes one): no retry can
+  // put it back, so no entry holds only the passing attempt's work.
+  let failedTouchedFound = false
+  // The committed files under the outputs as the first attempt found them,
+  // stamped only when a retry can follow.
+  let committedBefore: ReadonlyMap<string, OutputStamp> | undefined
+  let wsCommittedBefore: ReadonlyMap<string, OutputStamp> | undefined
+  // `outputs.clean: false` leaves the outputs to the first attempt's
   // command, and the save stores whatever they hold after it, a leftover
   // included: the user opted out of the clean-tree guarantee
   // (2026-10-15). A retry still starts clean. An additive task never cleans
   // by glob anyway.
-  const keepOutputs = !additive && (cacheCfg?.outputs.clean ?? args.cleanOutputs ?? true) === false
+  const keepOutputs = !additive && (cfgOut?.clean ?? args.cleanOutputs ?? true) === false
 
   // Cache lookup. On hit, time the user-perceived restore op
   // (clean+restore+log-replay) — that's what the framed-block footer
@@ -790,6 +918,14 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
           : {}),
       })
     : undefined
+  // The command's start for the re-check (`movedInput`), on the clock that
+  // stamps its writes: off `Date.now()`, a coarse kernel tick dated an edit
+  // in the command's first tick before it, and an edit undone by the end
+  // read as an upstream's write of the key's bytes. After the describe, so
+  // the stats that tell an upstream's write in its tick apart come first.
+  const commandFrom = cfgCacheable
+    ? fsClockNow(args.cacheDir ?? path.join(args.workspaceRoot, '.vx'))
+    : 0
   /** The other command that may have put a moved input back (`ownRewrite`). */
   let rewroteBy: string | undefined
   /**
@@ -834,7 +970,11 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         c.hash = MASKED + c.hash
   // The values of secret-named variables, masked in what the task prints
   // and what the cache keeps of it (L-11); null when there are none.
-  const secrets = secretMask([process.env, env, step.env?.define], step.env?.secret)
+  // Built again once the sandbox starts: its proxy token joins them.
+  const taskMask = (): SecretMask | null =>
+    secretMask([process.env, env, step.env?.define], step.env?.secret)
+  let secrets = taskMask()
+  let maskHeld = heldSecrets()
   // A runtime probe's row is named by its command, which a TS config may
   // build from `process.env`: the run history stored it and `vx why`
   // printed it (L-11).
@@ -856,16 +996,22 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const inputChanges = described !== undefined ? args.explainMiss?.(node.id, captured) : undefined
   // A plugin may keep the request past the run (the cache closed): it gets
   // the upstream outputs read now. Only the local floor leaves them unread.
-  if (inputs !== undefined && !isLocalExecutor(args.executor)) void inputs.upstream
+  if (inputs !== undefined && !isLocalExecutor(args.executor)) await described!.readUpstream()
   // A declared input set that resolves to NOTHING is the quiet stale hit:
   // the key stops moving with this project's source and every later run
   // is a hit. Almost always a glob written against the wrong directory
   // (`lib/**` in a package that builds `src/`). Said once per miss, on the
   // run's status line — the task itself succeeds.
   const declaredInputs = [...(cfg.inputs?.files ?? []), ...(cfg.inputs?.workspaceFiles ?? [])]
-  if (inputs !== undefined && declaredInputs.length > 0 && inputs.files.length === 0) {
+  const unmatched =
+    inputs === undefined || declaredInputs.length === 0
+      ? []
+      : inputs.files.length === 0
+        ? declaredInputs
+        : deadSourceGlobs(cfg.inputs, inputs.files, relPosix(args.workspaceRoot, node.projectDir))
+  if (unmatched.length > 0) {
     warnOf(log)(
-      `[vx] ${node.id}: inputs matched no files (${declaredInputs.join(', ')}) — ` +
+      `[vx] ${node.id}: inputs matched no files (${unmatched.join(', ')}) — ` +
         `the key will not change when this project's source does` +
         bracketLiteralHint([
           ...(cfg.inputs?.files ?? []).map((g) => [node.projectDir, g] as const),
@@ -889,7 +1035,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // Cache miss path (or caching disabled), up to `1 + retries` attempts.
   // Explicit config wins over the run-level `--retries` default, including
   // an explicit `retries: 0`.
-  const maxAttempts = 1 + (step.retries ?? args.retries ?? 0)
+  const retriesSet = step.retries !== undefined || args.retries !== undefined
+  let maxAttempts = 1 + (step.retries ?? args.retries ?? 0)
   let attempt = 0
   let result: ExecuteResult
   let effectiveExitCode: number
@@ -897,6 +1044,36 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // the last attempt alone read `max 407ms` beside a footer of 837 (item
   // 1101). A saved entry keeps the attempt that produced it, what a hit saves.
   let spentMs = 0
+  // A known flake gets a retry its config did not ask for (below).
+  const retryCanFollow =
+    maxAttempts > 1 || (!retriesSet && cfgCacheable && !keyless && args.knownFlaky !== undefined)
+  // Stamps the committed files a clean found before the first attempt, and
+  // before a retry taints the save if a failed attempt moved one.
+  const checkCommitted = (
+    root: string,
+    rels: readonly string[],
+    committed: (abs: string) => boolean,
+    before: ReadonlyMap<string, OutputStamp> | undefined,
+  ): ReadonlyMap<string, OutputStamp> | undefined => {
+    if (!retryCanFollow) return undefined
+    const files = rels.map((r) => path.resolve(root, r))
+    if (before === undefined) return stampCommitted(files, committed)
+    if (committedMoved(files, committed, before)) failedTouchedFound = true
+    return before
+  }
+
+  // vx's own work on the outputs, around a command that exited `exitCode`.
+  async function outputsStep<T>(
+    step: 'clean' | 'save',
+    exitCode: number,
+    work: () => Promise<T>,
+  ): Promise<T> {
+    try {
+      return await work()
+    } catch (err) {
+      throw new OutputsFailed(err, step, exitCode, spentMs)
+    }
+  }
 
   // One task attempt: clean the declared outputs (before EVERY attempt — so a
   // stale prior-build artifact can't survive into a fresh run, and a failed
@@ -909,6 +1086,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     result: ExecuteResult
     exitCode: number
     withdrawn?: true
+    unbegun?: true
   }> {
     // The first attempt under `clean: false` finds its last outputs (tsc's `.tsbuildinfo`).
     const clean = willWrite && !deferralRequested && !(keepOutputs && attempt === 1)
@@ -916,33 +1094,92 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // tree would replace a stale build with nothing at all. The eligibility
     // gate guarantees no key in this run can see what stays behind, and the
     // summary names every deferred task so `dist/` is not silently stale.
-    if (additive && willWrite && !deferralRequested && outputs.length > 0) {
-      const endStamp = span('miss: stamp outputs')
-      stampedBefore ??= await stampOutputs(cleanArgs)
-      endStamp()
-    } else if (clean && outputs.length > 0) {
-      // Mark the wiped paths, exactly as the workspace twin below does. The
-      // git snapshot still lists them with their committed index OIDs, and
-      // resolveFiles SKIPS its existence probe for any path carrying a
-      // trusted OID — so a declared output the producer deletes and does not
-      // re-create would stay in a same-project consumer's input set, keeping
-      // that consumer's key unchanged while the file is gone from disk.
-      const endClean = span('miss: clean outputs')
-      const cleanedRels = await cleanOutputs(cleanArgs)
-      endClean()
-      args.gitFilesCache?.markOutputsChanged(node.projectDir, cleanedRels)
-    }
-    if (additive && willWrite && !deferralRequested && wsOutputs.length > 0) {
-      // A root-anchored addition is stamped as the project one above: a
-      // glob clean deleted the upstream's files before this task, which
-      // reads them, ran (A-43).
-      wsStampedBefore ??= await stampWorkspaceOutputs(wsCleanArgs)
-    } else if (clean && wsOutputs.length > 0) {
-      // Root-anchored deletions can land in other projects' dirs; mark
-      // them so stale per-project git snapshots can't survive the wipe.
-      const cleanedWsRels = await cleanWorkspaceOutputs(wsCleanArgs)
-      args.gitFilesCache?.markWorkspaceOutputsChanged(args.workspaceRoot, cleanedWsRels)
-    }
+    // Its throw (a name vx cannot clear) fails the task before this
+    // attempt's command: no exit of its own to name.
+    await outputsStep('clean', attempt > 1 ? effectiveExitCode : 1, async () => {
+      if (additive && willWrite && !deferralRequested && outputs.length > 0) {
+        const endStamp = span('miss: stamp outputs')
+        if (stampedBefore === undefined) stampedBefore = await stampOutputs(cleanArgs)
+        else {
+          const rels = await dropFailedAdditions(
+            node.projectDir,
+            outputs,
+            stampedBefore,
+            cleanArgs.committed,
+            await ownOutputsSince(cleanArgs, stampedBefore),
+            () => resolveOutputs(cleanArgs),
+          )
+          args.gitFilesCache?.markOutputsChanged(node.projectDir, rels)
+        }
+        endStamp()
+      } else if (clean && outputs.length > 0) {
+        // Mark the wiped paths, exactly as the workspace twin below does. The
+        // git snapshot still lists them with their committed index OIDs, and
+        // resolveFiles SKIPS its existence probe for any path carrying a
+        // trusted OID — so a declared output the producer deletes and does not
+        // re-create would stay in a same-project consumer's input set, keeping
+        // that consumer's key unchanged while the file is gone from disk.
+        const endClean = span('miss: clean outputs')
+        const cleanedRels = await cleanOutputs(cleanArgs)
+        endClean()
+        args.gitFilesCache?.markOutputsChanged(node.projectDir, cleanedRels)
+        committedBefore = checkCommitted(
+          node.projectDir,
+          cleanedRels,
+          cleanArgs.committed,
+          committedBefore,
+        )
+      } else if (keepOutputs && willWrite && !deferralRequested && outputs.length > 0) {
+        committedBefore = checkCommitted(
+          node.projectDir,
+          retryCanFollow
+            ? (await resolveOutputs(cleanArgs)).map((f) => relPosix(node.projectDir, f))
+            : [],
+          cleanArgs.committed,
+          committedBefore,
+        )
+      }
+      if (additive && willWrite && !deferralRequested && wsOutputs.length > 0) {
+        // A root-anchored addition is stamped as the project one above: a
+        // glob clean deleted the upstream's files before this task, which
+        // reads them, ran (A-43).
+        if (wsStampedBefore === undefined)
+          wsStampedBefore = await stampWorkspaceOutputs(wsCleanArgs)
+        else {
+          const rels = await dropFailedAdditions(
+            args.workspaceRoot,
+            wsOutputs,
+            wsStampedBefore,
+            wsCleanArgs.committed,
+            await ownWorkspaceOutputsSince(wsCleanArgs, wsStampedBefore),
+            () => resolveWorkspaceOutputs(wsCleanArgs),
+          )
+          args.gitFilesCache?.markWorkspaceOutputsChanged(args.workspaceRoot, rels)
+        }
+      } else if (clean && wsOutputs.length > 0) {
+        // Root-anchored deletions can land in other projects' dirs; mark
+        // them so stale per-project git snapshots can't survive the wipe.
+        const cleanedWsRels = await cleanWorkspaceOutputs(wsCleanArgs)
+        args.gitFilesCache?.markWorkspaceOutputsChanged(args.workspaceRoot, cleanedWsRels)
+        wsCommittedBefore = checkCommitted(
+          args.workspaceRoot,
+          cleanedWsRels,
+          wsCleanArgs.committed,
+          wsCommittedBefore,
+        )
+      } else if (keepOutputs && willWrite && !deferralRequested && wsOutputs.length > 0) {
+        wsCommittedBefore = checkCommitted(
+          args.workspaceRoot,
+          retryCanFollow
+            ? (await resolveWorkspaceOutputs(wsCleanArgs)).map((f) =>
+                relPosix(args.workspaceRoot, f),
+              )
+            : [],
+          wsCleanArgs.committed,
+          wsCommittedBefore,
+        )
+      }
+    })
     // What the attempt before this one left, put back if this one is
     // withdrawn: it stands, with its output and its refusals.
     const standing = { output, violations, flushMasked }
@@ -984,6 +1221,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     } catch (thrown) {
       running = Promise.reject(thrown)
     }
+    // A failure that landed while the request was built: the executor holds it now.
+    if (args.failFast?.aborted === true) withdrawUnbegun?.()
     let res = await boundAfterAbort(running, req.signal)
       .then((r: unknown) => {
         assertExecuteResult(args.executor.name, node.id, r)
@@ -1036,6 +1275,15 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         throw thrown
       })
     endExec()
+    if (unbegun) {
+      await sweepPlaceholders(placeholders)
+      if (attempt === 1) return { result: res, exitCode: res.exitCode, unbegun: true }
+      // A retry withdrawn: the attempt before it stands, as above.
+      output = standing.output
+      violations = standing.violations
+      flushMasked = standing.flushMasked
+      return { result, exitCode: effectiveExitCode, withdrawn: true }
+    }
     if (secrets !== null)
       res = {
         ...res,
@@ -1087,12 +1335,18 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // A child we SIGTERMed for exceeding the timeout is a genuine failure —
     // stream a clear line so the 143 exit reads as a timeout. One that outlived
     // the grace died of the SIGKILL, and the line said SIGTERM over an exit
-    // 137 (item 1063).
+    // 137 (item 1063); so did a shell dead of the SIGTERM whose leftover the
+    // SIGKILL took.
     if (res.timedOut) {
-      const how = res.signal === 'SIGKILL' ? 'SIGKILL after the SIGTERM grace' : 'SIGTERM'
+      // A plugin executor's child is its own: core only aborted its request.
+      const how = !isLocalExecutor(args.executor)
+        ? 'its executor was aborted'
+        : res.signal === 'SIGKILL' || res.killedAfterGrace === true
+          ? 'killed (SIGKILL after the SIGTERM grace)'
+          : 'killed (SIGTERM)'
       log.taskStderr(
         node,
-        `${midLine ? '\n' : ''}[vx] timed out after ${effectiveTimeout}ms — killed (${how})\n`,
+        `${midLine ? '\n' : ''}[vx] timed out after ${effectiveTimeout}ms — ${how}\n`,
       )
       // Force a non-zero classification even if the child TRAPPED SIGTERM and
       // still exited 0 (`trap 'exit 0' TERM`, a common graceful-shutdown
@@ -1125,6 +1379,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         bins: taskBinDirs(node, args.workspaceRoot),
         signal: res.signal,
         hidden: req.sandbox && ((f: string) => !sandboxReads(req.sandbox!, f)),
+        stderr: errTail,
       })
       // The line quotes the command's first word, which a config may have
       // built from a secret: masked as the task's own output is (L-37).
@@ -1166,13 +1421,18 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // printed a blank line under the OUTPUT rule or the task's last line. Glued, a frame read
   // `partialvx: retrying …`.
   let midLine = false
+  /** The attempt's last stderr: the shell's "not found" line names the word a compound command missed (shell-verdict.ts). */
+  let errTail = ''
   // The attempt's output as the logger got it (masked): the entry's when
   // the task saves, else only what a failure reports (`failedOutput`).
   let output: BoundedCapture | undefined
   // Masked again whole: the live stream lets a held piece go after a pause.
-  const storeMask = secrets ?? undefined
-  const storedOutput = (): string => encodeOutputLog(output?.chunks() ?? [], storeMask)
+  const storedOutput = (): string => encodeOutputLog(output?.chunks() ?? [], secrets ?? undefined)
   const failedAttempts: { endedAt: number; exitCode: number; timedOut?: true }[] = []
+  // Each failed attempt's output, beside `failedAttempts`: kept for `vx last --log`.
+  const attemptOutputs: string[] = []
+  // Any attempt's shell left a process running, not only the last one's.
+  let leftRunning = false
   // The sampling of the attempt's process tree, stopped once it settles.
   let untrack: (() => TreeLoad | undefined) | undefined
   // What the last attempt's samples saw, for the run history.
@@ -1206,13 +1466,33 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   for (;;) {
     attempt++
     const a = await runAttempt()
+    // Never started: skipped, as fail-fast skips a task not yet dispatched.
+    if (a.unbegun) {
+      return {
+        node,
+        status: 'skipped',
+        exitCode: 1,
+        durationMs: 0,
+        hash,
+        wallclockStartNs,
+        wallclockEndNs: process.hrtime.bigint() - args.runStartHrTimeNs,
+      }
+    }
     result = a.result
     effectiveExitCode = a.exitCode
     if (a.withdrawn) {
       attempt--
       failedAttempts.pop()
+      attemptOutputs.pop()
       break
     }
+    // A failed attempt's leftover may write into the retry's outputs too.
+    // It is not killed, as a passing attempt's is not: only the save is
+    // withheld (`nothingLeftRunning`), and its dependents' (`args.leftRunning`).
+    if (result.leftRunning === true && !leftRunning) {
+      leftRunning = true
+      args.leftRunning?.(node)
+    }
     forgetUndeclaredWrites(args, writeReach)
     if (writesFingerprint) args.fingerprintWatch?.wrote()
     spentMs += result.durationMs
@@ -1252,25 +1532,77 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       }
     }
 
+    // A known flake gets the one retry its config did not ask for; a
+    // timeout always fails, and a task whose key names nothing (no cache
+    // block, or keyed on a keyless upstream) has no record to know it by.
+    if (
+      effectiveExitCode !== 0 &&
+      attempt === 1 &&
+      !retriesSet &&
+      result.timedOut !== true &&
+      cfgCacheable &&
+      !keyless &&
+      args.failFast?.aborted !== true &&
+      args.knownFlaky?.(node, hash) === true
+    )
+      maxAttempts = 2
     if (effectiveExitCode === 0 || attempt >= maxAttempts || args.failFast?.aborted === true) break
     failedAttempts.push({
       endedAt: Date.now(),
       exitCode: effectiveExitCode,
       ...(result.timedOut === true ? { timedOut: true as const } : {}),
     })
+    // The outcome's SANDBOX VIOLATIONS section is the last attempt's: a
+    // retried attempt's refusals go into its own output, kept for
+    // `vx last --log`, as the section prints them.
+    const refused = new Set<string>()
+    let denials = 0
+    for (const v of violations) {
+      const line = printable(secrets?.mask(v.line) ?? v.line)
+      if (!refused.has(line) && v.hint !== true) denials++
+      refused.add(line)
+    }
+    if (refused.size > 0 && output !== undefined) {
+      const section = `${midLine ? '\n' : ''}${denials > 0 ? `SANDBOX VIOLATIONS (${denials})` : 'SANDBOX'}\n${[...refused].join('\n')}\n`
+      output.push(section, true)
+      log.taskStderr(node, section)
+      midLine = false
+    }
+    attemptOutputs.push(
+      output === undefined ? '' : failedOutputLog(output, true, secrets ?? undefined),
+    )
+    // The shell's own exit 0 failed only on the refusal: `exit 1` named
+    // nothing that happened.
+    const why =
+      result.timedOut === true
+        ? 'a timeout'
+        : result.exitCode === 0 && denials > 0
+          ? `${denials} sandbox violation${denials === 1 ? '' : 's'}`
+          : `exit ${effectiveExitCode}`
     log.taskStderr(
       node,
-      `${midLine ? '\n' : ''}vx: retrying ${node.id} (attempt ${attempt + 1}/${maxAttempts}) after ${result.timedOut === true ? 'a timeout' : `exit ${effectiveExitCode}`}\n`,
+      `${midLine ? '\n' : ''}vx: retrying ${node.id} (attempt ${attempt + 1}/${maxAttempts}) after ${why}\n`,
     )
   }
 
   async function buildRequest(local: boolean): Promise<ExecuteRequest> {
+    // A remote executor enforces it where it runs the task. Armed before
+    // the streams' mask: its start holds the proxy's token, which the
+    // task's env carries (`initSandbox`).
+    if (userSandbox && args.executor.remote !== true) {
+      await args.armSandbox?.()
+      if (maskHeld !== heldSecrets()) {
+        maskHeld = heldSecrets()
+        secrets = taskMask()
+      }
+    }
     const kept =
       willSave || args.keepRun !== undefined
         ? new BoundedCapture()
         : new BoundedCapture(FAILED_OUTPUT_HEAD_CHARS, FAILED_OUTPUT_TAIL_CHARS)
     output = kept
     midLine = false
+    errTail = ''
     const toOut = (t: string): void => {
       kept.push(t)
       if (t.length > 0) midLine = !t.endsWith('\n')
@@ -1279,18 +1611,26 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     const toErr = (t: string): void => {
       kept.push(t, true)
       if (t.length > 0) midLine = !t.endsWith('\n')
+      errTail = (errTail + t).slice(-2048)
       log.taskStderr(node, t)
     }
     const masked = secrets && maskedStreams(secrets, toOut, toErr)
     flushMasked = () => masked?.end()
+    // A plugin executor gets frozen copies of what core goes on reading:
+    // the outputs it saves, the config two tasks declared alike share, the
+    // run's args. One that emptied its outputs saved an empty artifact a
+    // later hit restored; one that set its define ran the next task with it.
+    const own = <T extends object>(v: T): T =>
+      local ? v : Object.freeze(Array.isArray(v) ? ([...v] as T) : { ...v })
     const base: ExecuteRequest = {
       taskId: node.id,
+      ...(attempt > 1 ? { attempt } : {}),
       workspaceRoot: args.workspaceRoot,
       command: step.command,
-      forwardArgs: effectiveForwardArgs,
+      forwardArgs: own(effectiveForwardArgs),
       cwd: node.projectDir,
       env,
-      envDefine: step.env?.define ?? {},
+      envDefine: own(step.env?.define ?? {}),
       capture,
       onStdout: masked ? masked.out : toOut,
       onStderr: masked ? masked.err : toErr,
@@ -1309,11 +1649,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       ...(cfgCacheable && !remoteOnly && !willSave ? { unsaved: true } : {}),
       ...(remoteOnly ? { remoteOnly: true } : {}),
       ...(node.platform !== undefined ? { platform: node.platform } : {}),
+      ...(node.worker !== undefined ? { worker: node.worker } : {}),
       ...(deferralRequested ? { download: 'deferred' as const } : {}),
       // `--force`/`--no-cache` reach a remote executor's private record
       // through this flag — the policy gates above only cover vx's OWN cache.
       ...(cfgCacheable && !(policy.localRead || policy.remoteRead) ? { refresh: true } : {}),
-      outputs: { files: outputs, workspaceFiles: wsOutputs },
+      outputs: { files: own(outputs), workspaceFiles: own(wsOutputs) },
       ...(args.terminal === true ? { terminal: true as const } : {}),
       ...(args.servers === undefined
         ? {}
@@ -1324,11 +1665,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
           }),
     }
     // The signal last: it arms a plugin's `exec.timeout`, and the sandbox's arming
-    // below is vx's work, not the task's. Armed first, a 60 ms timeout
+    // above is vx's work, not the task's. Armed first, a 60 ms timeout
     // expired before the spawn and failed `echo` as timed out, unrun.
     if (!userSandbox) return { ...base, signal: requestSignal(local) }
-    // A remote executor enforces it where it runs the task.
-    if (args.executor.remote !== true) await args.armSandbox?.()
+    const deps = await dependencyReads(args.readableDeps?.(node) ?? [], args.workspaceRoot)
     const sb = await sandboxRequestFor(
       node,
       step.sandbox!,
@@ -1336,6 +1676,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       cfgCacheable ? args.keyedProjects(node) : undefined,
       args.nestedProjectDirs,
       args.cacheDir,
+      deps.reads,
+      deps.reported,
+      args.nestedDirsOf,
     )
     placeholders = sb.placeholders
     withheld = sb.withheld
@@ -1344,7 +1687,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
 
   const wallclockEndNs = process.hrtime.bigint() - args.runStartHrTimeNs
 
-  const stability = inputStabilityOf(args.node.config.cache, args.inputStability)
+  const stability = inputStabilityOf(args.node.config.inputs, args.inputStability)
   let movedFails: string | undefined
   let own: Awaited<ReturnType<typeof ownOutputs>>
   let saved = false
@@ -1364,7 +1707,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // edit's bytes under the old key (X-123).
     const materialize = result.outputs?.kind === 'deferred' ? result.outputs.materialize : undefined
     if (materialize !== undefined) {
-      const keyed = await keyStillTrue()
+      const keyed = (await keyStillTrue()) && (await args.serverDiedUnder?.(node)) !== true
       args.deferred?.register(node.id, {
         materialize,
         ...(keyed ? { hash } : {}),
@@ -1383,50 +1726,53 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     willSave &&
     nothingLeftRunning() &&
     (await keyStillTrue()) &&
+    (await args.serverDiedUnder?.(node)) !== true &&
     (own = await ownOutputs()) !== undefined
   ) {
-    const { landed } = await saveMiss({
-      ...own,
-      node,
-      hash,
-      cache,
-      log,
-      workspaceRoot: args.workspaceRoot,
-      nestedProjectDirs: args.nestedProjectDirs,
-      gitFilesCache: args.gitFilesCache,
-      outputs,
-      wsOutputs,
-      captured,
-      command: storedCommand,
-      durationMs: result.durationMs,
-      stdout: storedOutput(),
-      ...(result.cpuMs !== undefined ? { cpuMs: result.cpuMs } : {}),
-      ...(result.peakRssBytes !== undefined ? { peakRssBytes: result.peakRssBytes } : {}),
-      outputDirSnapshots: args.outputDirSnapshots,
-      deferSave: args.deferSave,
-      // A sink listens: say what the save cost.
-      measure: args.explainMiss !== undefined,
-    })
+    const { landed } = await outputsStep('save', effectiveExitCode, () =>
+      saveMiss({
+        ...own,
+        node,
+        hash,
+        cache,
+        log,
+        workspaceRoot: args.workspaceRoot,
+        nestedProjectDirs: args.outputNestedDirs ?? args.nestedProjectDirs,
+        gitFilesCache: args.gitFilesCache,
+        outputs,
+        wsOutputs,
+        captured,
+        command: storedCommand,
+        durationMs: result.durationMs,
+        stdout: storedOutput(),
+        ...(result.cpuMs !== undefined ? { cpuMs: result.cpuMs } : {}),
+        ...(result.peakRssBytes !== undefined ? { peakRssBytes: result.peakRssBytes } : {}),
+        outputDirSnapshots: args.outputDirSnapshots,
+        deferSave: args.deferSave,
+        // A sink listens: say what the save cost.
+        measure: args.explainMiss !== undefined,
+      }),
+    )
     // A run that settles the outcome on `landed` learns there whether the
-    // entry is in; without one, the save is taken as done.
+    // entry is in; without one, the save is done (a `--force` save may have kept the entry it found).
     if (args.deferredSaves !== undefined) args.deferredSaves.set(node.id, landed)
-    else saved = true
+    else saved = (await landed).saved === true
   } else if (cfgCacheable && !remoteOnly && !deferralRequested && args.noDependants === true) {
     // Nothing reads after it, so nothing to mark: only its row's `outputs`.
     if (effectiveExitCode === 0)
       unsavedBytes = await unsavedOutputBytes({
         node,
         workspaceRoot: args.workspaceRoot,
-        nestedProjectDirs: args.nestedProjectDirs,
+        nestedProjectDirs: args.outputNestedDirs ?? args.nestedProjectDirs,
         outputs,
         wsOutputs,
       })
   } else if (cfgCacheable && !remoteOnly && !deferralRequested) {
     // Ran here and saves nothing — failed, a read-only policy, a tainted
-    // upstream, a key that no longer held — yet it wrote what a save would
-    // have marked, and may have rewritten an input the re-check before a
-    // save catches. A same-run reader keyed from the snapshot's OIDs for
-    // either replayed the bytes from before the command (item 750). A
+    // upstream, a server that died under it, a key that no longer held —
+    // yet it wrote what a save would have marked, and may have rewritten an
+    // input the re-check before a save catches. A same-run reader keyed
+    // from the snapshot's OIDs for either replayed the bytes from before the command (item 750). A
     // withheld save already dropped the project; this finds the same move
     // again and drops it again.
     const endCheck = span('miss: recheck inputs')
@@ -1438,7 +1784,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       unsavedBytes = await markUnsaved({
         node,
         workspaceRoot: args.workspaceRoot,
-        nestedProjectDirs: args.nestedProjectDirs,
+        nestedProjectDirs: args.outputNestedDirs ?? args.nestedProjectDirs,
         gitFilesCache: args.gitFilesCache,
         outputs,
         wsOutputs,
@@ -1449,11 +1795,13 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   /**
    * What an additive run saves as its own, or undefined when it removed a
    * file it found: no entry replays a removal (`ownOutputsSince`), so the
-   * task saves nothing and runs again.
+   * task saves nothing and runs again. Undefined too for any task when a
+   * failed attempt moved a file no clean removed (`failedTouchedFound`).
    */
   async function ownOutputs(): Promise<
     { ownOutputFiles?: string[]; ownWsOutputFiles?: string[] } | undefined
   > {
+    if (failedTouchedFound) return undefined
     const mine: { ownOutputFiles?: string[]; ownWsOutputFiles?: string[] } = {}
     if (stampedBefore !== undefined) {
       const files = await ownOutputsSince(cleanArgs, stampedBefore)
@@ -1468,13 +1816,36 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     return mine
   }
 
+  /**
+   * Before an additive task's retry: remove what the failed attempt added
+   * against the first stamp, as an exclusive task's clean removes it, so
+   * the stamp still tells the retry's work from what the task found. A
+   * found file it changed or removed stays as it is and taints the save.
+   * Returns the removed paths, `root`-relative.
+   */
+  async function dropFailedAdditions(
+    root: string,
+    outs: readonly string[],
+    before: ReadonlyMap<string, OutputStamp>,
+    committed: (abs: string) => boolean,
+    changed: string[] | undefined,
+    walk: () => Promise<string[]>,
+  ): Promise<string[]> {
+    const added = (changed ?? (await walk())).filter((f) => !before.has(f))
+    if (changed === undefined || added.length < changed.length) failedTouchedFound = true
+    const rels = added.map((f) => relPosix(root, f))
+    if (rels.length > 0)
+      await cleanOutputPaths({ projectDir: root, rels, outputs: outs, committed })
+    return rels
+  }
+
   /**
    * A process the shell left behind still held its output when the drain
    * bound cut it, so it may still write outputs: a save now would file a
    * tree the run does not leave, and a hit elsewhere would replay it.
    */
   function nothingLeftRunning(): boolean {
-    if (result.leftRunning !== true) return true
+    if (!leftRunning) return true
     warnOf(log)(
       `[vx] ${node.id}: a process it left running may still write its outputs — ` +
         `the result stands, but is not saved; wait for it in the command (\`wait\`)`,
@@ -1495,12 +1866,22 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       const changed = new Set(result.changed.map((f) => path.join(args.workspaceRoot, f)))
       const there = keyedInputs(described!.facts).find((f) => changed.has(f.path))
       if (there !== undefined) return there.path
+      // One the key never folded, as this disk lacks it (untracked there),
+      // that the declaration matches: the command read it, and its entry
+      // here was every later run's hit (2026-11-07).
+      const dir = relPosix(args.workspaceRoot, node.projectDir)
+      for (const f of result.changed) {
+        const own = relPosix(node.projectDir, path.join(args.workspaceRoot, f))
+        const projectRel = own.startsWith('../') ? null : own
+        if (declaresInput(cfg, projectRel, f, false, true, dir))
+          return path.join(args.workspaceRoot, f)
+      }
     }
     return (
       (await movedInput(
         keyedInputs(described!.facts),
         cache,
-        described!.describedAt,
+        commandFrom,
         stability.strategy === 'mutable' ? ownRewrite : undefined,
       )) ?? described!.added()
     )
@@ -1525,36 +1906,77 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // `'unchecked'` skips the check of the command's own window; a key the
     // re-derive before the command already disagreed with still withholds,
     // since it never described the bytes the command read.
-    if (stability.strategy === 'unchecked' && described!.hash === hash) return true
+    // Unchecked, the command may still have rewritten an input in place: a
+    // later reader keyed after it (stable-keys.ts) must not read the
+    // project's run-start facts.
+    if (stability.strategy === 'unchecked' && described!.hash === hash) {
+      if (args.executor.remote !== true)
+        forgetUndeclaredWrites(
+          args,
+          wsOutputs.length > 0 ? 'workspace' : commandWriteReach(node, args.workspaceRoot),
+        )
+      return true
+    }
     const endCheck = span('miss: recheck inputs')
     const moved = await movedSinceKey()
     endCheck()
     if (moved === undefined) return true
-    const what =
-      (moved === null ? 'its inputs' : `\`${printable(relPosix(args.workspaceRoot, moved))}\``) +
-      ' changed after its key was taken' +
-      (rewroteBy === undefined ? '' : ` while ${rewroteBy} ran`)
+    const name =
+      moved === null ? 'its inputs' : `\`${printable(relPosix(args.workspaceRoot, moved))}\``
+    // Only its ctime moved: a hard link (`cp -al src dist`), chmod or chown.
+    // The line called that a change and offered a rewrite's way out. It is
+    // still withheld: an edit undone with its mtime put back reads the same.
+    // Not said of a change an executor reported from where it ran.
+    const fact =
+      moved === null || rewroteBy !== undefined || (result.changed?.length ?? 0) > 0
+        ? undefined
+        : keyedInputs(described!.facts).find((f) => f.path === moved)
+    const ctimeOnly = fact !== undefined && (await onlyCtimeMoved(fact, commandFrom, cache))
+    const what = ctimeOnly
+      ? `${name}'s ctime moved while the task ran, but not its bytes or mtime (a hard link, chmod or chown)`
+      : `${name} changed after its key was taken` +
+        (rewroteBy === undefined ? '' : ` while ${rewroteBy} ran`)
     // A task that regenerates its own input (TanStack Router's committed
     // `routeTree.gen.ts`, rewritten to the same bytes by every build) is
     // never saved (item 1015), and the line said so without the way out.
+    // A file the key read may instead be one the task rewrites in place (a
+    // formatter's temp + rename), whose sources cannot be its outputs: vx
+    // deletes outputs before the command. Its way out is judging the write
+    // by its bytes. Neither is said of a file this disk lacks: one the task
+    // deleted, or one only where an executor ran it.
+    const read =
+      moved !== null &&
+      keyedInputs(described!.facts).some((f) => f.path === moved && f.digest !== ABSENT_INPUT)
+    // Under watch the edit starts the next cycle, which runs on it: said
+    // first, or the way out read as the fix for the user's own edit.
     const hint =
-      moved === null || rewroteBy !== undefined
-        ? ''
-        : '; if the task writes it, declare it in cache.outputs'
+      (args.watch === true && rewroteBy === undefined ? '; the next cycle runs on it' : '') +
+      (ctimeOnly
+        ? "; if the task hard-links it, copy it instead, or set inputs.stability: { strategy: 'mutable' }"
+        : moved === null || rewroteBy !== undefined || !existsSync(moved)
+          ? ''
+          : '; if the task generates it, declare it in outputs' +
+            (read && stability.strategy !== 'mutable'
+              ? "; if it rewrites it in place, set inputs.stability: { strategy: 'mutable' }"
+              : ''))
     if (stability.severity === 'error') {
       warnOf(log)(
         `[vx] ${node.id}: ${what} — the result is not saved, ` +
-          `and inputStability.severity is 'error', so the task fails${hint}`,
+          `and inputs.stability.severity is 'error', so the task fails${hint}`,
       )
       movedFails = moved === null ? '' : printable(relPosix(args.workspaceRoot, moved))
     } else {
       warnOf(log)(
-        `[vx] ${node.id}: ${what} — the result stands, ` +
-          `but is not saved under a key that no longer describes it${hint}`,
+        `[vx] ${node.id}: ${what} — ` +
+          (ctimeOnly
+            ? 'vx cannot tell that from an edit undone, so the result stands but is not saved'
+            : 'the result stands, but is not saved under a key that no longer describes it') +
+          hint,
       )
     }
     forgetUndeclaredWrites(args, wsOutputs.length > 0 ? 'workspace' : 'project')
     unkeyed = true
+    driftedInput = moved
     return false
   }
 
@@ -1577,17 +1999,24 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     durationMs: spentMs,
     hash,
     ...(attempt > 1 ? { attempts: attempt } : {}),
-    ...(failedAttempts.length > 0 ? { failedAttempts } : {}),
+    ...(failedAttempts.length > 0 ? { failedAttempts, attemptOutputs } : {}),
     ...(described !== undefined
       ? { inputFiles: captured.reduce((n, c) => (c.kind === 'file' ? n + 1 : n), 0) }
       : {}),
     ...(inputChanges !== undefined ? { inputChanges } : {}),
     ...(unkeyed ? { unkeyed: true as const } : {}),
+    ...(driftedInput !== undefined ? { driftedInput } : {}),
     ...(keylessBy !== undefined ? { keylessBy } : {}),
     ...(saved ? { saved: true as const } : {}),
     ...(unsavedBytes !== undefined ? { outputBytes: unsavedBytes } : {}),
     ...(effectiveExitCode !== 0 && output !== undefined
-      ? { failedOutput: failedOutputLog(output, willSave || args.keepRun !== undefined, storeMask) }
+      ? {
+          failedOutput: failedOutputLog(
+            output,
+            willSave || args.keepRun !== undefined,
+            secrets ?? undefined,
+          ),
+        }
       : {}),
     ...(args.keepRun !== undefined &&
     (effectiveExitCode !== 0 ? args.keepRun.failures : !willSave) &&
@@ -1628,3 +2057,48 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       : {}),
   }
 }
+
+/**
+ * The wildcard input globs, when not one of them matched a file: the
+ * literal files beside them did. A lockfile plugin appends `package.json`
+ * to every task's inputs, so `scr/**` for `src/**` kept a non-empty set
+ * and its warning went unsaid: an edit to `src/` then replayed a stale hit.
+ * On the miss path only; stops at the first matched file.
+ */
+function deadSourceGlobs(
+  declared: InputsConfig | undefined,
+  files: readonly { readonly path: string }[],
+  projectRel: string,
+): string[] {
+  const wild = (globs: readonly string[] | undefined): string[] =>
+    (globs ?? []).filter((g) => !g.startsWith('!') && !isLiteralPattern(g))
+  const own = wild(declared?.files)
+  const ws = wild(declared?.workspaceFiles)
+  if (own.length === 0 && ws.length === 0) return []
+  const ownMatch = anyTaskGlob(own)
+  const wsMatch = anyTaskGlob(ws)
+  const prefix = projectRel === '' ? '' : `${projectRel}/`
+  for (const { path: p } of files) {
+    if (wsMatch(p)) return []
+    if (p.startsWith(prefix) && ownMatch(p.slice(prefix.length))) return []
+  }
+  return [...own, ...ws]
+}
+
+/**
+ * Whether a moved input kept the bytes and the mtime its key folded, so only
+ * its ctime moved. Asked once, of the file a re-check named: the common
+ * path pays nothing.
+ */
+async function onlyCtimeMoved(fact: InputFact, from: number, cache: CacheLayer): Promise<boolean> {
+  if (fact.digest === ABSENT_INPUT || fact.behind !== undefined) return false
+  let st
+  try {
+    st = lstatSync(fact.path)
+  } catch {
+    return false
+  }
+  if (st.ctimeMs < from - stampGrainMs(st.ctimeMs)) return false
+  if (st.mtimeMs >= from - stampGrainMs(st.mtimeMs)) return false
+  return (await cache.hashFile(fact.path).catch(() => undefined)) === fact.digest
+}