fix(sandbox): report the no-install path so the cache denominator is knowable

[pedrofrxncx]

Follow-up to #5346/#5351. Found while checking whether the L2 cache is live in prod — it isn't, but the metric that will judge it has a blind spot big enough to change the buy decision.

The gap

sandbox.deps.restore emits on a restore hit and on a completed install. It emits nothing on the installPromise === null early return — and that's the path every Deno project takes: deno fetches at runtime, there is no node_modules, so no golden tier (L1 or the L2 EFS archive) can ever help it.

Measured in prod just now, 12 live sandbox pods on image 1.26.1:

	count
[dev] $ deno task dev	4
bun / npm / pnpm / yarn	1
unclaimed or idle, no dev script	7
emitted any sandbox.deps* line	1

So today the log reads as "barely any dependency traffic" when the truth is "most of these boots are a runtime the cache cannot serve."

Why it blocks the decision, not just the dashboard

The Deno share is the ceiling on what any golden tier can win. Without a line on that path it is invisible, and we'd be sizing an EFS filesystem against a denominator we can't see — buying a shared filesystem to serve a fraction of boots we never measured.

no-install makes the denominator knowable:

stats by (source) count()
  l1 | l2 | miss   → tiers, hit rate, and the saving
  no-install       → boots no cache can ever serve

The one real datapoint the metric did produce

{"msg":"sandbox.deps.restore","source":"miss","repo_hash":"f73290d25d81db55","duration_ms":26652}

deco-sites/decocms-tanstack, 312 deps, 26.6s cold install. That's the per-boot cost L2 would shave — worth having on the record since it's the first prod figure for it.

Testing

New orchestrator test drives a Deno project (task-bearing deno.json, no package manifest) so spawnInstall has nothing to run, and asserts the label. Guarded: deleting the emit fails it (verified 13 pass / 1 fail).

bun test packages/sandbox/daemon/setup/ → 98 pass. knip clean, lint 0 errors.

Scope

Deliberately not instrumented: the fingerprint-skip resume path. A resume isn't a cold boot and studio.sandbox.ensure.outcome already splits fresh vs resume — adding an arm here would double-count.

---

Summary by cubic

Emit no-install events in sandbox.deps.restore so cache metrics include boots with no install step. This makes Deno and manifest-less repos visible and lets us size L2 correctly.

• Bug Fixes
  • Added no-install to RestoreSource and emit when installPromise is null (e.g., Deno, no manifest).
  • Wrote an orchestrator test that runs a Deno project and asserts source: "no-install".
  • Left resume/fingerprint-skip path untouched to avoid double counting.

^{Written for commit 50295de. Summary will update on new commits.}