@vzn/vx 0.0.652 → 0.0.653

package/src/exec/runner.ts

@@ -13,6 +13,7 @@ import {
   isOutOfFds,
   killGraceMs,
   OUT_OF_FDS_HINT,
+  POST_EXIT_DRAIN_MS,
   testTimerMs,
   helperEnv,
   type SecretMask,
@@ -20,6 +21,7 @@ import {
 import {
   type Child,
   closeSignalChannel,
+  groupAlive,
   holdGroups,
   killTree,
   releaseGroup,
@@ -51,6 +53,9 @@ export interface RunResult {
    *  Distinguishes a timeout (a real `failed`) from a Ctrl-C shutdown
    *  SIGTERM (which the orchestrator reverts to `aborted`). */
   timedOut?: boolean
+  /** The timeout's SIGKILL past the grace took a process of the task's
+   *  group: the child, or one it left after dying of the SIGTERM. */
+  killedAfterGrace?: true
   /** Total user+system CPU time for the child, in milliseconds. */
   cpuMs?: number
   /** Peak resident set size for the child, in bytes. */
@@ -58,9 +63,10 @@ export interface RunResult {
   /** `Bun.spawn` threw: no shell ran, so its 127 is vx's and says nothing
    *  about the command (A-41). */
   spawnFailed?: true
-  /** The shell exited while a process it started still held its
-   *  stdout/stderr past the drain bound (`POST_EXIT_CUT_LINE`): that process
-   *  may still write the task's outputs, so the result is not saved. */
+  /** The shell exited while a process it started still ran: one holding
+   *  stdout/stderr past the drain bound (`POST_EXIT_CUT_LINE`), or one left
+   *  in the task's process group. It may still write the task's outputs,
+   *  so the result is not saved. */
   leftRunning?: true
 }
 
@@ -182,7 +188,12 @@ export function shellQuote(arg: string): string {
  * `<<X` in a comment or quotes opens no heredoc, and a quote in a body
  * opens nothing (X-110).
  */
-function shellShape(command: string): { comment: number; body: boolean[]; subshell: boolean } {
+function shellShape(command: string): {
+  comment: number
+  body: boolean[]
+  subshell: boolean
+  quoted: boolean
+} {
   const lines = command.split('\n')
   const body = lines.map(() => false)
   const pending: Array<{ delim: string; tabs: boolean }> = []
@@ -261,9 +272,36 @@ function shellShape(command: string): { comment: number; body: boolean[]; subshe
     }
     atWordStart = /[\s;&|()<>]/.test(c)
   }
-  return { comment, body, subshell }
+  return { comment, body, subshell, quoted: quote !== '' }
 }
 
+// One redirection at the end of a command: an fd, an operator, and a
+// target word (quoted parts and `<(…)` / `>(…)` included).
+const TRAILING_REDIRECT =
+  /(?:^|[\s)])(?:&>>?|\d*(?:<<<|>>|>&|<&|<>|>\||>|<))[ \t]*(?:[<>]\([^()]*\)|(?:[^\s;&|()<>'"\\]|\\.|'[^']*'|"(?:[^"\\]|\\.)*")+)$/
+
+/**
+ * Where trailing redirections start, when a compound command's closer
+ * stands before them (`(cmd) 2>&1`, `done < f`), or -1. One inside quotes
+ * or a comment is not peeled.
+ */
+function redirectsAfterCloser(command: string): number {
+  let head = command
+  for (;;) {
+    const m = TRAILING_REDIRECT.exec(head)
+    if (m === null) break
+    const start = m.index + (/^[\s)]/.test(m[0]) ? 1 : 0)
+    const rest = head.slice(0, start)
+    const shape = shellShape(rest)
+    if (shape.quoted || shape.comment >= 0 || /(?:^|[^\\])(?:\\\\)*\\$/.test(rest)) break
+    head = rest.trimEnd()
+  }
+  if (head.length === command.length) return -1
+  return shellShape(head).subshell || COMPOUND_CLOSER.test(head) ? head.length : -1
+}
+
+const COMPOUND_CLOSER = /(?:^|[^\\])(?:\\\\)*[;&\n][ \t]*(fi|done|esac|\})$/
+
 /**
  * The command a task runs with the args after `--` appended, shell-quoted.
  * They go before a trailing comment: appended after it, `echo args: # show`
@@ -300,10 +338,12 @@ export function withForwardArgs(command: string, args: readonly string[] | undef
     // After a compound command's closer they were a syntax error
     // (`(cmd) --fix`, `fi --fix`): they go to the last command inside it.
     // A closer word counts only where a command starts, after a separator.
-    const closer = shape.subshell
-      ? ')'
-      : /(?:^|[^\\])(?:\\\\)*[;&\n][ \t]*(fi|done|esac|\})$/.exec(trimmed)?.[1]
+    const closer = shape.subshell ? ')' : COMPOUND_CLOSER.exec(trimmed)?.[1]
     const end = sep ?? closer
+    // Redirections after the closer (`(cmd) 2>&1`, `done < f`) hid it: the
+    // args go inside it and the redirections stay after.
+    const at = end === undefined ? redirectsAfterCloser(trimmed) : -1
+    if (at >= 0) return `${withForwardArgs(trimmed.slice(0, at), args)}${trimmed.slice(at)}`
     if (end !== undefined) {
       const head = trimmed.slice(0, -end.length).trimEnd()
       return `${withForwardArgs(head, args)}${trimmed.slice(head.length)}`
@@ -504,7 +544,8 @@ function afterPendingExits(fn: () => void): ReturnType<typeof setTimeout> {
  * classify the resulting SIGTERM as a real failure rather than a
  * Ctrl-C abort — and `settle()`, awaited once the child has exited:
  * it cancels the timers and, when the timeout fired, waits out the rest
- * of the grace for the child's GROUP and SIGKILLs whoever is left. The
+ * of the grace for the child's GROUP and SIGKILLs whoever is left, and
+ * `sigkilled()` says whether that SIGKILL found anyone. The
  * shell dying on the SIGTERM is not the tree dying: a backgrounded
  * process that ignores it lived on under init after vx exited (nx#11782's
  * sibling, reproduced on vx 2026-09-24). A no-op (never fires, nothing
@@ -513,16 +554,18 @@ function afterPendingExits(fn: () => void): ReturnType<typeof setTimeout> {
 export function armTimeout(
   proc: ReturnType<typeof Bun.spawn>,
   timeoutMs: number | undefined,
-): { timedOut: () => boolean; settle: () => Promise<void> } {
-  if (timeoutMs === undefined) return { timedOut: () => false, settle: async () => {} }
+): { timedOut: () => boolean; sigkilled: () => boolean; settle: () => Promise<void> } {
+  if (timeoutMs === undefined)
+    return { timedOut: () => false, sigkilled: () => false, settle: async () => {} }
   let firedAt: number | undefined
+  let sigkilled = false
   let killTimer: ReturnType<typeof setTimeout> | undefined
   const graceMs = killGraceMs(TIMEOUT_SIGKILL_GRACE_MS)
   let timer = setTimeout(() => {
     timer = afterPendingExits(fire)
   }, timeoutMs)
   function fire(): void {
-    firedAt = Date.now()
+    firedAt = performance.now()
     killTree(proc, 'SIGTERM')
     // Escalate to SIGKILL after a grace: a child that TRAPS+IGNORES SIGTERM
     // (`trap '' TERM`) would otherwise defeat the timeout entirely and hang
@@ -530,35 +573,26 @@ export function armTimeout(
     // timeout, so a wedged child hangs the whole run forever. Mirrors the
     // end-of-run persistent-shutdown escalation. Unref'd so it never keeps
     // the CLI alive.
-    killTimer = setTimeout(() => killTree(proc, 'SIGKILL'), graceMs)
+    killTimer = setTimeout(() => {
+      sigkilled = true
+      killTree(proc, 'SIGKILL')
+    }, graceMs)
     killTimer.unref?.()
   }
   return {
     timedOut: () => firedAt !== undefined,
+    sigkilled: () => sigkilled,
     settle: async () => {
       clearTimeout(timer)
       if (killTimer !== undefined) clearTimeout(killTimer)
       if (firedAt === undefined) return
-      const left = await untilGroupsGone([proc], Math.max(0, firedAt + graceMs - Date.now()))
+      const left = await untilGroupsGone([proc], Math.max(0, firedAt + graceMs - performance.now()))
       for (const child of left) killTree(child, 'SIGKILL')
+      if (left.length > 0) sigkilled = true
     },
   }
 }
 
-/**
- * Grace after the direct child exits before we abort the stdout/stderr readers.
- * The pipe reaches EOF only when EVERY write-end fd is closed, so a task that
- * backgrounds a process inheriting fd 1/2 (`server & echo up` — `execWrap`
- * leaves compound commands as `sh -c`, so `sh` exits while the grandchild holds
- * the pipe) never EOFs. On a clean exit with no lingering writer the pipe EOFs
- * at once, so the readers win this race immediately and normal tasks pay
- * nothing; only a stuck reader waits out the grace. Residual buffered output is
- * bounded by the OS pipe buffer (streamToString drains continuously DURING the
- * run), so this is far longer than any real drain needs. What the leftover
- * process writes after the bound is lost, and `POST_EXIT_CUT_LINE` says so.
- */
-const POST_EXIT_DRAIN_MS = 250
-
 /**
  * The line a task's frame gets when the drain bound cut its pipes. The cut
  * was silent: a backgrounded child's late output vanished from the frame and
@@ -746,6 +780,8 @@ export interface PersistentSpawn {
   ready: Promise<void>
   /** ms from spawn to ready, to the readiness timeout giving up, or to now. */
   readyMs: () => number
+  /** Whether the readiness timeout fired: `ready` rejects only after the kill grace. */
+  gaveUp: () => boolean
 }
 
 // `capture` is a `runCommand` concept: a persistent task never returns a
@@ -765,6 +801,12 @@ export interface PersistentOptions extends Omit<RunOptions, 'forwardArgs' | 'cap
    * resolves before the timer can fire).
    */
   timeoutMs?: number
+  /**
+   * Called once, at ready: after `onStdout` / `onStderr` had the text up to
+   * the end of the ready line, before anything after it. What follows is
+   * the since-ready stream; a chunk holding both is split there.
+   */
+  onReady?: () => void
   /**
    * Spawn it with fd 3 as its signal channel and route its polite signals
    * there (`signalThrough`): a Linux sandboxed command, whose group signal
@@ -781,11 +823,14 @@ export interface PersistentOptions extends Omit<RunOptions, 'forwardArgs' | 'cap
  * `onStderr` callbacks for the whole lifetime of the child.
  */
 export function runPersistent(opts: PersistentOptions): PersistentSpawn {
-  const start = Date.now()
+  const start = performance.now()
   let readyAt: number | undefined
   // When the readiness wait gave up: the wait's length, not the kill grace
   // a TERM-trapping server runs out after it.
   let gaveUpAt: number | undefined
+  // The shell exited non-zero before a match: a marker read after it, from
+  // a child it left running, cannot make an exited server ready.
+  let failedExit = false
 
   // Pattern compiled once; thrown errors surface synchronously so the
   // caller can wrap with a user-facing message.
@@ -839,13 +884,19 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
     const message =
       isExecutableMissing(err) && !existsSync(opts.cwd)
         ? `its working directory ${opts.cwd} does not exist`
-        : spawnErrorReason(err, opts.signalChannel === true ? SANDBOXED_TASK : 'task', opts.command)
+        : spawnErrorReason(
+            err,
+            opts.signalChannel === true ? SANDBOXED_TASK : 'task',
+            opts.command,
+            opts.env,
+          )
     return {
       child: undefined,
       ready: Promise.reject(
         new PersistentReadyError(`failed to spawn persistent task: ${message}`, 'spawn'),
       ),
-      readyMs: () => Date.now() - start,
+      readyMs: () => Math.round(performance.now() - start),
+      gaveUp: () => false,
     }
   } finally {
     pipes.spawned()
@@ -860,10 +911,11 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
 
   const markReady = (): void => {
     // A marker printed on the way down, once the wait gave up, is not ready.
-    if (readyAt === undefined && gaveUpAt === undefined) {
-      readyAt = Date.now()
+    if (readyAt === undefined && gaveUpAt === undefined && !failedExit) {
+      readyAt = performance.now()
       if (readyTimer !== undefined) clearTimeout(readyTimer)
       resolveReady()
+      opts.onReady?.()
     }
   }
 
@@ -884,45 +936,60 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   ): Promise<void> => {
     if (!stream || typeof stream === 'number') return
     let fragment = ''
-    const handleChunk = (chunk: string): void => {
-      if (chunk.length === 0) return
-      // Chunks are forwarded, never retained. The one consumer of a
-      // persistent task's text is the logger, which keeps its OWN bounded
-      // tail fed from these same callbacks (registered at taskStart, so it
-      // covers the pre-ready window too) — a second copy here was read by
-      // nobody.
-      if (isStderr) opts.onStderr?.(chunk)
-      else opts.onStdout?.(chunk)
-      if (readyRe && readyAt === undefined) {
-        fragment += chunk
-        let start = 0
-        for (let i = 0; i < fragment.length; i++) {
-          const c = fragment.charCodeAt(i)
-          if (c !== 10 && c !== 13) continue
-          if (readyLine(readyRe, fragment.slice(start, i))) {
-            markReady()
-            fragment = ''
-            return
-          }
-          start = i + 1
-        }
-        fragment = fragment.slice(start)
-        if (readyLine(readyRe, fragment)) {
-          markReady()
+    // Chunks are forwarded, never retained. The one consumer of a
+    // persistent task's text is the logger, which keeps its OWN bounded
+    // tail fed from these same callbacks (registered at taskStart, so it
+    // covers the pre-ready window too) — a second copy here was read by
+    // nobody.
+    const forward = (text: string): void => {
+      if (text.length === 0) return
+      if (isStderr) opts.onStderr?.(text)
+      else opts.onStdout?.(text)
+    }
+    // Where in `chunk` the ready line ends (past its break, a CRLF's `\n`
+    // too), or -1 while not ready. The fragment holds no break, so every
+    // break found is in `chunk`.
+    const readyEnd = (re: RegExp, chunk: string): number => {
+      const base = fragment.length
+      fragment += chunk
+      let start = 0
+      for (let i = base; i < fragment.length; i++) {
+        const c = fragment.charCodeAt(i)
+        if (c !== 10 && c !== 13) continue
+        if (readyLine(re, fragment.slice(start, i))) {
           fragment = ''
-          return
-        }
-        // Dropping complete lines assumes the stream HAS line breaks. Output
-        // with none is one endless line, so the fragment would become a
-        // third unbounded accumulator (measured 464 MiB in 6 s, and the
-        // per-chunk `test` over an ever-growing string makes it quadratic
-        // in CPU too). Keep the most RECENT window: a match may span the
-        // chunk boundary, and no readiness marker is anywhere near this
-        // long.
-        if (fragment.length > READY_MATCH_WINDOW_CHARS) {
-          fragment = fragment.slice(fragment.length - READY_MATCH_WINDOW_CHARS)
+          return i + 1 - base + (c === 13 && chunk.charCodeAt(i + 1 - base) === 10 ? 1 : 0)
         }
+        start = i + 1
+      }
+      fragment = fragment.slice(start)
+      if (readyLine(re, fragment)) {
+        fragment = ''
+        return chunk.length
       }
+      // Dropping complete lines assumes the stream HAS line breaks. Output
+      // with none is one endless line, so the fragment would become a
+      // third unbounded accumulator (measured 464 MiB in 6 s, and the
+      // per-chunk `test` over an ever-growing string makes it quadratic
+      // in CPU too). Keep the most RECENT window: a match may span the
+      // chunk boundary, and no readiness marker is anywhere near this
+      // long.
+      if (fragment.length > READY_MATCH_WINDOW_CHARS) {
+        fragment = fragment.slice(fragment.length - READY_MATCH_WINDOW_CHARS)
+      }
+      return -1
+    }
+    const handleChunk = (chunk: string): void => {
+      if (chunk.length === 0) return
+      if (!readyRe || readyAt !== undefined) return forward(chunk)
+      const end = readyEnd(readyRe, chunk)
+      if (end < 0) return forward(chunk)
+      // Split where the ready line ends: handed over whole, the lines after
+      // it in the same write read as pre-ready, the frame a ready server's
+      // row never prints (Vite's `Network:` line after `Local:`).
+      forward(chunk.slice(0, end))
+      markReady()
+      forward(chunk.slice(end))
     }
     const reader = stream.getReader()
     const decoder = new TextDecoder('utf-8', { ignoreBOM: true })
@@ -959,9 +1026,10 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   // fires so a healthy server is never killed by a stale timer.
   let readyTimer: ReturnType<typeof setTimeout> | undefined
   if (readyRe && opts.timeoutMs !== undefined) {
+    const limit = opts.timeoutMs
     const giveUp = async (): Promise<void> => {
       if (readyAt !== undefined) return
-      gaveUpAt = Date.now()
+      gaveUpAt = performance.now()
       // Listed on the group guard until the SIGKILL: the shell may die on
       // the SIGTERM and let the group go while the server runs out the
       // grace, and a vx killed inside it leaves the server to the guard
@@ -979,8 +1047,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
       }
       rejectReady(
         new PersistentReadyError(
-          `persistent task not ready within ${opts.timeoutMs}ms — ` +
-            `readyWhen pattern never matched; child killed`,
+          `no line matched readyWhen /${readyRe.source}/ within ${asWritten(limit)}; killed`,
           'timeout',
         ),
       )
@@ -996,8 +1063,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
     opts.liveChildren?.delete(child)
     releaseServerGroup(child)
     if (readyTimer !== undefined) clearTimeout(readyTimer)
-    // The exit can land before the readers took the marker it printed on
-    // the way out: `echo READY; exit` read as never ready under load. The
+    if (code !== 0) failedExit = true
+    // What the shell wrote reaches the frame before the failure line. The
     // drain is bounded, as a task's is, for a grandchild holding the pipe.
     if (readyAt === undefined && gaveUpAt === undefined) {
       await Promise.race([
@@ -1012,8 +1079,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
     if (readyAt === undefined && gaveUpAt === undefined) {
       rejectReady(
         new PersistentReadyError(
-          `persistent task exited before becoming ready (exit ${code ?? '?'})` +
-            (readyRe ? ` — readyWhen pattern never matched` : ''),
+          `exited (exit ${code ?? '?'})` +
+            (readyRe ? ` before a line matched readyWhen /${readyRe.source}/` : ''),
           'exited',
           code ?? undefined,
         ),
@@ -1028,7 +1095,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   return {
     child,
     ready,
-    readyMs: () => (readyAt ?? gaveUpAt ?? Date.now()) - start,
+    readyMs: () => Math.round((readyAt ?? gaveUpAt ?? performance.now()) - start),
+    gaveUp: () => gaveUpAt !== undefined,
   }
 }
 
@@ -1049,6 +1117,8 @@ export function spawnFailureText(
   cwd: string,
   what = 'task',
   command?: string,
+  /** The spawn's environment: an `E2BIG` it caused names it, not the command. */
+  env?: NodeJS.ProcessEnv,
 ): string {
   if (isExecutableMissing(err)) {
     // Bun names `sh` in the ENOENT a missing directory gives too.
@@ -1056,28 +1126,47 @@ export function spawnFailureText(
       ? `[vx] vx runs each task with sh -c: failed to spawn 'sh' (working dir: ${cwd}). Install a POSIX sh and re-run.\n`
       : `[vx] failed to spawn ${what}: its working directory ${cwd} does not exist\n`
   }
-  return `[vx] failed to spawn ${what}: ${spawnErrorReason(err, what, command)}\n`
+  return `[vx] failed to spawn ${what}: ${spawnErrorReason(err, what, command, env)}\n`
 }
 
 /** Bun's text for a spawn that threw, and the way out when the limit hit is a known one. */
-function spawnErrorReason(err: unknown, what: string, command: string | undefined): string {
+function spawnErrorReason(
+  err: unknown,
+  what: string,
+  command: string | undefined,
+  env?: NodeJS.ProcessEnv,
+): string {
   const message = err instanceof Error ? err.message : String(err)
   const hint = isOutOfFds(err)
     ? ` — ${OUT_OF_FDS_HINT}`
     : command !== undefined && (err as NodeJS.ErrnoException | undefined)?.code === 'E2BIG'
-      ? ` — ${argTooLongHint(command, what === SANDBOXED_TASK)}`
+      ? ` — ${argTooLongHint(command, what === SANDBOXED_TASK, env)}`
       : ''
   return `${message}${hint}`
 }
 
+const MAX_ARG_STRLEN = 128 * 1024
+
 /**
  * A task's command, the args after `--` folded in, is ONE argument to
  * `sh -c`, and Linux caps one argument at 128 KiB (MAX_ARG_STRLEN), far
  * below the argv total: a file list forwarded to a linter failed with a
  * bare E2BIG, which reads as "too many files" and names no way out.
  */
-function argTooLongHint(command: string, wrapped: boolean): string {
-  const kib = Math.ceil(Buffer.byteLength(command) / 1024)
+function argTooLongHint(command: string, wrapped: boolean, env?: NodeJS.ProcessEnv): string {
+  const bytes = Buffer.byteLength(command)
+  const kib = Math.ceil(bytes / 1024)
+  // The limit counts the environment too, and caps each entry as it does
+  // one argument: a task's 4.4 MB `define` was blamed on its 1 KiB command.
+  const vars = env === undefined ? null : envSize(env)
+  if (vars !== null && (bytes <= MAX_ARG_STRLEN || vars.bytes > bytes)) {
+    return (
+      `the task environment is ${Math.ceil(vars.bytes / 1024)} KiB in ${vars.count} variables, ` +
+      `largest ${vars.largest} at ${Math.ceil(vars.largestBytes / 1024)} KiB; Linux caps one ` +
+      `entry at 128 KiB and the command with the environment at a quarter of the stack limit ` +
+      `(often 2 MiB): pass large values through a file the tool reads`
+    )
+  }
   const what = wrapped ? "with the args after -- and the sandbox's wrap" : 'with the args after --'
   return (
     `the command, ${what}, is ${kib} KiB, and one argument to sh -c may hold at ` +
@@ -1085,6 +1174,30 @@ function argTooLongHint(command: string, wrapped: boolean): string {
   )
 }
 
+/** What `execve` copies of an environment: each `name=value` and its NUL. */
+function envSize(env: NodeJS.ProcessEnv): {
+  bytes: number
+  count: number
+  largest: string
+  largestBytes: number
+} {
+  let bytes = 0
+  let count = 0
+  let largest = ''
+  let largestBytes = 0
+  for (const [name, value] of Object.entries(env)) {
+    if (value === undefined) continue
+    const entry = Buffer.byteLength(name) + Buffer.byteLength(value) + 2
+    bytes += entry
+    count++
+    if (entry > largestBytes) {
+      largest = name
+      largestBytes = entry
+    }
+  }
+  return { bytes, count, largest, largestBytes }
+}
+
 /** A stop's own sweep, for a child it missed: the polite signal, then SIGKILL past the grace. */
 async function stopLate(proc: Child, signal: 'SIGINT' | 'SIGTERM'): Promise<void> {
   const letGo = holdGroups([proc])
@@ -1098,7 +1211,9 @@ async function stopLate(proc: Child, signal: 'SIGINT' | 'SIGTERM'): Promise<void
 }
 
 export async function runCommand(opts: RunOptions): Promise<RunResult> {
-  const start = Date.now()
+  // Elapsed time, not wall time: an NTP step mid-task gave a negative or
+  // hour-long duration (the executor check refuses a negative one).
+  const start = performance.now()
   const fullCommand = withForwardArgs(opts.command, opts.forwardArgs)
 
   let proc: Child
@@ -1148,11 +1263,11 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
             )
     } catch (err) {
       pipes.close()
-      const stderr = spawnFailureText(err, opts.cwd, 'task', fullCommand)
+      const stderr = spawnFailureText(err, opts.cwd, 'task', fullCommand, opts.env)
       opts.onStderr?.(stderr)
       return {
         exitCode: 127,
-        durationMs: Date.now() - start,
+        durationMs: Math.round(performance.now() - start),
         stdout: '',
         stderr,
         spawnFailed: true,
@@ -1196,6 +1311,10 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   const cutLine = ends.own(POST_EXIT_CUT_LINE)
   if (cut) opts.onStderr?.(cutLine)
   const stderr = cut ? streamed + cutLine : streamed
+  // A leftover with its stdio sent elsewhere holds no pipe for the drain to
+  // cut: its group, still not empty, is what says so. One kill(0) when the
+  // group is empty, as it is after any task that waits for what it starts.
+  const left = cut || groupAlive(proc)
   opts.liveChildren?.delete(proc)
   releaseGroup(proc)
   const exited = proc.exitCode ?? (proc.signalCode ? signalExitCode(proc.signalCode) : 1)
@@ -1210,7 +1329,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
     opts.onStderr?.(text)
     return {
       exitCode: 127,
-      durationMs: Date.now() - start,
+      durationMs: Math.round(performance.now() - start),
       stdout,
       stderr: stderr + text,
       spawnFailed: true,
@@ -1221,12 +1340,13 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   const exitCode = exited === 0 && timeout.timedOut() ? signalExitCode('SIGTERM') : exited
   return {
     exitCode,
-    durationMs: Date.now() - start,
+    durationMs: Math.round(performance.now() - start),
     stdout,
     stderr,
     ...(proc.signalCode != null ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
-    ...(cut ? { leftRunning: true } : {}),
+    ...(timeout.sigkilled() ? { killedAfterGrace: true } : {}),
+    ...(left ? { leftRunning: true } : {}),
     ...usageOf(proc, watch?.stop()),
   }
 }
@@ -1288,8 +1408,9 @@ function rssFloorFor(peak: number): number {
 
 /**
  * What a task's captured output keeps: the first `CAPTURE_HEAD_CHARS` and
- * the last `CAPTURE_TAIL_CHARS` characters, the dropped middle counted and
- * named where it was. The live stream is never bounded — every byte still
+ * the last `CAPTURE_TAIL_CHARS` characters (UTF-16 units: 8 MiB of ASCII),
+ * the dropped middle counted in the UTF-8 bytes the task wrote and named
+ * where it was. The live stream is never bounded — every byte still
  * reaches the terminal as the task writes it — only the copy vx retains
  * for the cache entry and its replay. Unbounded, a task printing 200 MB
  * cost vx 620 MB of RSS on the miss AND on every hit, and its stdout sat
@@ -1328,10 +1449,22 @@ export function maskCaptured(text: string, secrets: SecretMask): string {
 }
 
 const DROPPED_LINE = /^\n\[vx\] [\d.]+ [KMGTP]?B of output not kept — /
+const SIZE = '[\\d.]+ [KMGTP]?B'
+const OWN_DROPPED_LINE = new RegExp(
+  `\\n\\[vx\\] ([\\d.]+) ([KMGTP]?B) of output not kept — vx keeps the first ${SIZE} and the last ${SIZE} of a task's output\\n`,
+  'y',
+)
+const UNITS = ['B', 'KB', 'MB', 'GB', 'TB', 'PB']
+
+/**
+ * The dropped lines `chunks()` returned, known by the object, not the text:
+ * a task's own chunk that read like one was copied past the mask.
+ */
+const droppedChunks = new WeakSet<CapturedChunk>()
 
-/** Whether `chunk` is the line a `BoundedCapture` puts where its dropped middle was. */
+/** Whether `chunk` is the line a `BoundedCapture` put where its dropped middle was (the object `chunks()` returned). */
 export function isDroppedOutputChunk(chunk: CapturedChunk): boolean {
-  return !chunk.err && DROPPED_LINE.test(chunk.text)
+  return droppedChunks.has(chunk)
 }
 
 const isHighSurrogate = (code: number): boolean => code >= 0xd800 && code <= 0xdbff
@@ -1354,7 +1487,9 @@ export class BoundedCapture {
   private headLen = 0
   private readonly tail: CapturedChunk[] = []
   private tailLen = 0
+  /** UTF-8 bytes: a count of UTF-16 units said a third of the bytes CJK text dropped. */
   private dropped = 0
+  private seen = 0
 
   constructor(
     private readonly headChars = CAPTURE_HEAD_CHARS,
@@ -1362,6 +1497,29 @@ export class BoundedCapture {
   ) {}
 
   push(text: string, err = false): void {
+    // A capture's own output replayed into another (a distributed miss
+    // replays the worker's entry): its dropped line, where a capture puts
+    // it, is counted, not kept. Kept as text, it fell into the new middle
+    // and the entry said `98 B of output not kept` for 13 MB.
+    const at = CAPTURE_HEAD_CHARS - this.seen
+    this.seen += text.length
+    if (!err && at >= 0 && at <= text.length) {
+      // At the head's end, or a unit short of it (a surrogate pair's split).
+      for (const i of [at, at - 1]) {
+        if (i < 0) continue
+        OWN_DROPPED_LINE.lastIndex = i
+        const m = OWN_DROPPED_LINE.exec(text)
+        if (m === null) continue
+        this.dropped += Math.round(Number(m[1]) * 1024 ** UNITS.indexOf(m[2]!))
+        this.add(text.slice(0, i), err)
+        text = text.slice(i + m[0].length)
+        break
+      }
+    }
+    this.add(text, err)
+  }
+
+  private add(text: string, err: boolean): void {
     // Once the tail has begun the head is closed, even a unit short of its
     // bound (the surrogate case below): a later short chunk fit there and
     // was retained ahead of the chunk before it.
@@ -1387,12 +1545,12 @@ export class BoundedCapture {
       if (first.text.length <= excess) {
         this.tail.shift()
         this.tailLen -= first.text.length
-        this.dropped += first.text.length
+        this.dropped += Buffer.byteLength(first.text)
       } else {
         const cut = isHighSurrogate(first.text.charCodeAt(excess - 1)) ? excess + 1 : excess
+        this.dropped += Buffer.byteLength(first.text.slice(0, cut))
         this.tail[0] = { text: first.text.slice(cut), err: first.err }
         this.tailLen -= cut
-        this.dropped += cut
       }
     }
   }
@@ -1401,8 +1559,10 @@ export class BoundedCapture {
    * The same output under tighter bounds. What this capture already
    * dropped is counted in the new one's dropped line: pushed through
    * `chunks()`, the old line fell into the new middle with its count.
-   * `through` maps each side's chunks before the new cut (the store's
-   * mask), so the cut cannot split a value first.
+   * `through` maps the chunks before the new cut (the store's mask), so
+   * the cut cannot split a value first: each side apart only when this
+   * capture dropped text between them, else a value across the head's end
+   * was matched by neither side.
    */
   rebound(
     headChars: number,
@@ -1410,24 +1570,21 @@ export class BoundedCapture {
     through: (chunks: CapturedChunk[]) => CapturedChunk[] = (c) => c,
   ): BoundedCapture {
     const to = new BoundedCapture(headChars, tailChars)
-    for (const c of through(this.head)) to.push(c.text, c.err)
-    for (const c of through(this.tail)) to.push(c.text, c.err)
+    const sides = this.dropped === 0 ? [[...this.head, ...this.tail]] : [this.head, this.tail]
+    for (const side of sides) for (const c of through(side)) to.push(c.text, c.err)
     to.dropped += this.dropped
     return to
   }
 
   /** The kept chunks in arrival order, the dropped middle named on stdout. */
   chunks(): CapturedChunk[] {
-    return this.dropped === 0
-      ? [...this.head, ...this.tail]
-      : [
-          ...this.head,
-          {
-            text: droppedOutputLine(this.dropped, this.headChars, this.tailChars),
-            err: false,
-          },
-          ...this.tail,
-        ]
+    if (this.dropped === 0) return [...this.head, ...this.tail]
+    const line = {
+      text: droppedOutputLine(this.dropped, this.headChars, this.tailChars),
+      err: false,
+    }
+    droppedChunks.add(line)
+    return [...this.head, line, ...this.tail]
   }
 
   text(): string {
@@ -1553,3 +1710,8 @@ export function resourceUsageToCpuRss(
   const floor = typeof floorBytes === 'number' ? floorBytes : floorBytes(peak)
   return peak > floor + RSS_FLOOR_SLACK_BYTES ? { cpuMs, peakRssBytes: peak } : { cpuMs }
 }
+
+/** A limit as a config writes it: `'2s'` reads back `2s`, not `2000ms`. */
+function asWritten(ms: number): string {
+  return ms % 1000 === 0 ? `${ms / 1000}s` : `${ms}ms`
+}