@@ -108,6 +108,10 @@ limits, and required install commands.
   scanned project, so a Yarn Berry project's `global` script can't run or pick
   the directory treated as the global install. Composer's global home also
   falls back to `%APPDATA%\Composer` and `$XDG_CONFIG_HOME/composer`.
+- Gem hosted and vendored modes wire only the manifest Bundler loads. A `gems.rb`
+  twin or a `BUNDLE_GEMFILE` setting (environment or `.bundle/config`) no longer
+  leads to an edit of an ignored `Gemfile` that reports success and attests an
+  unpatched gem; unsupported layouts are refused before any write (#341, #390).
 - **npm dependencies installed from git, a URL or `file:` are no longer
   reported patched.** npm installs such a dependency from the dependent's
   spec (`github:user/repo`, `https://…/x.tgz`, `file:…`) and ignores the
@@ -154,6 +158,9 @@ limits, and required install commands.
 - Python rewrites preserve supported markers, groups, extras, source metadata, and
   integrity pins. Relocks, out-of-tree environments, and lock-only VEX are handled
   consistently with each installer's supported behavior.
+- Hosted Pipenv scans read the `Pipfile`, so a conflicting `Pipfile.lock` entry
+  refuses the patch project-wide instead of half-redirecting a sibling
+  `requirements.txt` (#333).
 - Vendoring reuses valid committed artifacts during service outages. Updates do
   not build from a previous patch's modified bytes. Verified service artifacts
   keep their identity; integrity failures do not fall through to a local rebuild.
@@ -168,6 +175,15 @@ limits, and required install commands.
 - Transient apply locks are removed on normal command exit; no-op scans and full
   reversal avoid leaving unused `.socket/` state. Terminal output, telemetry
   timeouts, and update-check handling are more consistent.
+- npm locks keep their own layout when edited. `scan --mode hosted`,
+  `scan --mode vendored`, `rollback` and `vendor --revert`
+  re-serialized `package-lock.json` / `npm-shrinkwrap.json` with LF line
+  endings (and, in hosted mode, a fixed 2-space indent), so a CRLF or
+  tab-indented lock got a whole-file diff and the undo did not restore its
+  bytes. A lock with a UTF-8 BOM, which npm installs from, was skipped as
+  unparseable (hosted) or refused as `vendor_lockfile_version_unsupported`
+  (vendored). The lock now keeps its BOM, indent and line endings, and the
+  undo is byte-exact (#324).
 
 ### Maintenance
 
 
@@ -1714,7 +1714,14 @@ async fn apply_patches_inner(
     // by ledger key, resolved base purl, or qualifier-stripped key so
     // release-variant manifest keys (pypi `?artifact_id=`…) hit too;
     // unreadable state degrades to "nothing vendored" (fail-open).
-    let vendored_purls = socket_patch_core::vendor::vendored_purl_keys(&args.common.cwd).await;
+    // The ledger owns the PROJECT's copies only: a global apply restores
+    // and patches the global copy even when the cwd project vendors the
+    // same purl (see `project_state_in_scope`).
+    let vendored_purls = if crate::commands::project_state_in_scope(&args.common) {
+        socket_patch_core::vendor::vendored_purl_keys(&args.common.cwd).await
+    } else {
+        Default::default()
+    };
     let is_vendored = |p: &str| purl_keys_cover(&vendored_purls, p);
     let (mut results, mut matched_manifest_purls, vendored_bases) =
         synthesize_vendor_owned_results(&target_manifest_purls, &vendored_purls);
 
@@ -914,8 +914,9 @@ fn format_save_summary(
 
 /// The summary after a single-uuid save. `what` is `"Patch"` or `"Patch
 /// record"`. `ends_run` says an unchanged record really ends the run (the
-/// agent path skips apply); the vendored path still runs its vendor step,
-/// so it must not promise "nothing to update".
+/// agent path under `--save-only`); the agent path still re-applies an
+/// unchanged record and the vendored path still runs its vendor step, so
+/// neither may promise "nothing to update".
 fn format_single_save(
     what: &str,
     action: &PatchAction,
@@ -1653,6 +1654,10 @@ struct FetchBatch {
     /// Selection size after installed-release narrowing.
     found: usize,
     skipped: usize,
+    /// Manifest store only: the `skipped` patches whose same uuid is
+    /// already recorded — still owed a nested apply, since the installed
+    /// copy may have been reinstalled since the record was written.
+    already_recorded: usize,
     failed: usize,
     /// Fetched, recordable patches in selection order.
     fetched: Vec<FetchedPatch>,
@@ -1843,6 +1848,7 @@ async fn fetch_selected_patches(
     let mut batch = FetchBatch {
         found: selected.len(),
         skipped: 0,
+        already_recorded: 0,
         failed: 0,
         fetched: Vec::new(),
         reused: Vec::new(),
@@ -1997,6 +2003,7 @@ async fn fetch_selected_patches(
                 "action": "skipped",
             }));
             batch.skipped += 1;
+            batch.already_recorded += 1;
             continue;
         }
 
@@ -2432,10 +2439,16 @@ pub async fn download_and_apply_patches_with(
             return (1, serde_json::json!({ "status": "error", "error": msg }));
         }
     }
+    // Every selected patch that is now recorded is owed the nested apply:
+    // the fetched ones AND the already-recorded (`skipped`) ones, whose
+    // installed copy may be pristine again after a reinstall or a failed
+    // earlier apply (#454). Apply is idempotent on already-patched files,
+    // so an in-sync re-run stays a no-op on disk.
+    let to_apply = downloaded + batch.already_recorded;
     // The lock outlives the manifest write only when a nested apply follows
     // (it is handed the guard and releases it after its last mutation);
     // otherwise nothing more is written and it is released here.
-    let apply_lock = if !params.save_only && downloaded > 0 {
+    let apply_lock = if !params.save_only && to_apply > 0 {
         Some(guard)
     } else {
         drop(guard);
@@ -2476,21 +2489,21 @@ pub async fn download_and_apply_patches_with(
         .await;
     }
 
-    // An apply step that ran (patches were added, not --save-only) but
-    // failed is a partial failure too — not just download failures. The
+    // An apply step that ran (recorded patches selected, not --save-only)
+    // but failed is a partial failure too — not just download failures. The
     // `status` field must agree with `exit_code`; reporting `success`
     // alongside a non-zero exit code misleads JSON consumers (the scan
     // wrapper recomputes status from the exit code for exactly this
     // reason, but `get` surfaces this envelope directly).
-    let apply_failed = !apply_succeeded && downloaded > 0 && !params.save_only;
+    let apply_failed = !apply_succeeded && to_apply > 0 && !params.save_only;
     let (status, exit_code) = run_outcome(batch.failed > 0, apply_failed);
     let mut result_json = serde_json::json!({
         "status": status,
         "found": batch.found,
         "downloaded": downloaded,
         "skipped": batch.skipped,
         "failed": batch.failed,
-        "applied": if apply_succeeded { downloaded } else { 0 },
+        "applied": if apply_succeeded { to_apply } else { 0 },
         "updated": updated,
         "patches": batch.patches_json,
     });
@@ -2527,6 +2540,12 @@ pub async fn run(args: GetArgs) -> i32 {
         } else {
             super::scan::ScanMode::Hosted
         });
+    // Global installs have no project lockfile: an explicit hosted or
+    // vendored mode would rewire the cwd project, not the global copy.
+    if let Some(conflict) = super::global_mode_conflict(&args.common, mode) {
+        report_error(args.common.json, conflict);
+        return 2;
+    }
     if args.save_only && mode != super::scan::ScanMode::Agent {
         report_error(
             args.common.json,
@@ -3390,9 +3409,12 @@ async fn save_and_apply_patch(args: &GetArgs, client: &ApiClient, patch: &PatchR
         Err(code) => return code,
     };
     let changed = action != PatchAction::Skipped;
-    // Carried into the nested apply when one follows (it releases the lock
-    // after its last mutation), released here otherwise.
-    let apply_lock = if !args.save_only && changed {
+    // The record is now in the manifest whatever `action` says, so the
+    // nested apply follows unless `--save-only`: a same-uuid re-get must
+    // still reconcile an installed copy that was reinstalled pristine since
+    // it was recorded (#454). Carried into the nested apply (it releases
+    // the lock after its last mutation), released here otherwise.
+    let apply_lock = if !args.save_only {
         Some(guard)
     } else {
         drop(guard);
@@ -3427,7 +3449,14 @@ async fn save_and_apply_patch(args: &GetArgs, client: &ApiClient, patch: &PatchR
     if !quiet {
         eprintln!(
             "{}",
-            format_single_save("Patch", &action, &manifest_path, &patch.purl, true)
+            format_single_save(
+                "Patch",
+                &action,
+                &manifest_path,
+                &patch.purl,
+                // An unchanged record ends the run only when no apply follows.
+                apply_lock.is_none()
+            )
         );
     }
 
@@ -3446,11 +3475,11 @@ async fn save_and_apply_patch(args: &GetArgs, client: &ApiClient, patch: &PatchR
         .await;
     }
 
-    // The apply step ran (patch added, not --save-only) but failed →
+    // The apply step ran (not --save-only) but failed →
     // partial failure. The `status` field must agree with the exit code
     // returned below; a hardcoded `success` alongside a non-zero exit
     // misleads JSON consumers.
-    let apply_failed = !apply_succeeded && changed && !args.save_only;
+    let apply_failed = !apply_succeeded && !args.save_only;
     // No "download failed" concept here — a blob failure early-returns
     // with status `error` above — so only the apply step can degrade us.
     let (status, exit_code) = run_outcome(false, apply_failed);
 
@@ -34,6 +34,44 @@ pub(crate) const HOSTED_MODE_LABEL: &str = "hosted";
 /// `record`, so the ledger is the only place those records live.
 pub(crate) const VENDORED_MODE_LABEL: &str = "vendored";
 
+/// Whether the run's target includes the `--cwd` project's own
+/// lockfile-backed state: its hosted pins and its vendor ledger. Global
+/// scope (`--global` / `--global-prefix`) targets globally installed
+/// packages, which have no project lockfile (CLI_CONTRACT.md, Mode
+/// resolution). The project a global run happens to start in is not its
+/// target, so that project's hosted and vendored state is never rewired,
+/// unwound, or consulted for ownership of a global copy.
+pub(crate) fn project_state_in_scope(common: &crate::args::GlobalArgs) -> bool {
+    !common.is_global()
+}
+
+/// The usage error for a mode that rewires the project (`hosted`,
+/// `vendored`) under global scope, or `None` when `mode` is allowed.
+/// Shared by `scan` and `get` so both refuse the same combinations with
+/// the same wording.
+pub(crate) fn global_mode_conflict(
+    common: &crate::args::GlobalArgs,
+    mode: scan::ScanMode,
+) -> Option<String> {
+    if project_state_in_scope(common) {
+        return None;
+    }
+    let why = match mode {
+        scan::ScanMode::Agent => return None,
+        scan::ScanMode::Hosted => "redirect",
+        scan::ScanMode::Vendored => "wire vendored artifacts into",
+    };
+    Some(format!(
+        "{} cannot be used with --mode {}: global installs have no project lockfile to {why}",
+        if common.global {
+            "--global"
+        } else {
+            "--global-prefix"
+        },
+        mode.cli_name(),
+    ))
+}
+
 /// Lockfile discovery of `root` (core `vex::discover`): the hosted and
 /// vendored patch references its lockfiles and configs wire, with hosted
 /// references counted on Socket's public patch server plus the operator's
 
@@ -345,13 +345,24 @@ pub async fn run(args: RemoveArgs) -> i32 {
     // must not see `.socket/` created and pruned again). The vendor ledger
     // is loaded under the lock below; the hosted pins come from read-only
     // lockfile discovery (the restore re-reads every file under the lock).
+    //
+    // Under global scope the project's hosted pins and vendor ledger are
+    // not this run's to unwind (see `project_state_in_scope`): a global
+    // remove restores the global copies and drops their manifest records
+    // only.
+    let project_state = crate::commands::project_state_in_scope(&args.common);
     let manifest_missing = tokio::fs::metadata(&manifest_path).await.is_err();
-    let hosted_inventory = crate::commands::hosted_inventory(&args.common, cwd).await;
+    let hosted_inventory = if project_state {
+        crate::commands::hosted_inventory(&args.common, cwd).await
+    } else {
+        Default::default()
+    };
     let hosted_pins: Vec<HostedPin> = hosted_inventory.pins.clone();
     if manifest_missing {
-        let vendor_ledger_exists = tokio::fs::metadata(cwd.join(VENDOR_STATE_REL))
-            .await
-            .is_ok();
+        let vendor_ledger_exists = project_state
+            && tokio::fs::metadata(cwd.join(VENDOR_STATE_REL))
+                .await
+                .is_ok();
         if !vendor_ledger_exists && hosted_pins.is_empty() {
             // Contested hosted wiring is still hosted state: name it
             // instead of reporting a bare project.
@@ -440,7 +451,11 @@ pub async fn run(args: RemoveArgs) -> i32 {
     // the vendored leg. An unreadable ledger degrades to "nothing vendored"
     // for the rollback and fails closed at the vendored leg — exactly where
     // the run is about to mutate vendored state.
-    let vendor_state_result = load_state(cwd).await;
+    let vendor_state_result = if project_state {
+        load_state(cwd).await
+    } else {
+        Ok(VendorState::default())
+    };
 
     if matching.is_empty() {
         // Ledger-only entries (vendored mode keeps no manifest record) —
 
@@ -1043,7 +1043,10 @@ pub(crate) async fn retire_legacy_redirect_ledger(common: &GlobalArgs) -> Option
     let path = common
         .cwd
         .join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL);
-    if common.dry_run || tokio::fs::symlink_metadata(&path).await.is_err() {
+    if common.dry_run
+        || !crate::commands::project_state_in_scope(common)
+        || tokio::fs::symlink_metadata(&path).await.is_err()
+    {
         return None;
     }
     let remaining = crate::commands::discover_wiring(common, &common.cwd).await;
@@ -1111,13 +1114,23 @@ pub async fn run(args: RollbackArgs) -> i32 {
     // themselves are LOADED UNDER the apply lock below: this run persists
     // mutated clones of the ledgers, so a pre-lock snapshot could clobber
     // a concurrent run's writes with stale state.
+    //
+    // Under global scope the project's hosted pins and vendor ledger are
+    // not this run's to unwind (see `project_state_in_scope`): a global
+    // rollback restores the global copies and their manifest records only.
+    let project_state = crate::commands::project_state_in_scope(&args.common);
     let manifest_missing = tokio::fs::metadata(&manifest_path).await.is_err();
-    let vendor_ledger_exists = tokio::fs::metadata(cwd.join(".socket/vendor/state.json"))
-        .await
-        .is_ok();
+    let vendor_ledger_exists = project_state
+        && tokio::fs::metadata(cwd.join(".socket/vendor/state.json"))
+            .await
+            .is_ok();
     // The hosted pins the lockfiles wire (read-only discovery; the restore
     // re-reads every file under the lock before it writes).
-    let hosted_inventory = crate::commands::hosted_inventory(&args.common, &cwd).await;
+    let hosted_inventory = if project_state {
+        crate::commands::hosted_inventory(&args.common, &cwd).await
+    } else {
+        Default::default()
+    };
     let hosted_pins: Vec<HostedPin> = hosted_inventory.pins.clone();
 
     if manifest_missing && !vendor_ledger_exists && hosted_pins.is_empty() {
@@ -1131,7 +1144,7 @@ pub async fn run(args: RollbackArgs) -> i32 {
         // so there is nothing to restore — retire the stale file (a wet run
         // only) instead of failing on the missing manifest.
         let legacy = cwd.join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL);
-        if tokio::fs::symlink_metadata(&legacy).await.is_ok() {
+        if project_state && tokio::fs::symlink_metadata(&legacy).await.is_ok() {
             let warning = retire_legacy_redirect_ledger(&args.common).await;
             if args.common.json {
                 println!(
@@ -1167,7 +1180,11 @@ pub async fn run(args: RollbackArgs) -> i32 {
         // with lockfiles still consuming `.socket/vendor/` artifacts: the
         // ledger holds the pre-vendor originals, so it must come back from
         // version control first.)
-        let wired = crate::commands::vendored_backend::repair::scan_vendor_references(&cwd).await;
+        let wired = if project_state {
+            crate::commands::vendored_backend::repair::scan_vendor_references(&cwd).await
+        } else {
+            Default::default()
+        };
         if !wired.is_empty() {
             emit_rollback_error(
                 args.common.json,
@@ -1213,7 +1230,22 @@ pub async fn run(args: RollbackArgs) -> i32 {
     // Load the state stores UNDER the lock (see the discovery note above),
     // each exactly once: the agent leg below receives the manifest and the
     // vendor-ownership key set instead of re-reading them.
-    let vendor_state_result = socket_patch_core::vendor::load_state(&cwd).await;
+    //
+    // Under global scope the ledger is read only to keep the project's
+    // vendored manifest records (see the cleanup below): no vendored leg
+    // runs, and the ledger does not own the global copies, so the in-place
+    // leg restores them.
+    let loaded_vendor_state = socket_patch_core::vendor::load_state(&cwd).await;
+    let project_vendored_keys: HashSet<String> = loaded_vendor_state
+        .as_ref()
+        .map(VendorState::purl_keys)
+        .unwrap_or_default();
+    let ledger_unreadable = loaded_vendor_state.is_err();
+    let vendor_state_result = if project_state {
+        loaded_vendor_state
+    } else {
+        Ok(VendorState::default())
+    };
     let vendor_corrupt = vendor_state_result.is_err();
     // An unreadable ledger degrades to "nothing vendored" for the in-place
     // leg (its own containment is the `vendor_state_unreadable` exit below).
@@ -1558,7 +1590,11 @@ pub async fn run(args: RollbackArgs) -> i32 {
                 .filter(|r| !r.success)
                 .map(|r| r.package_key.clone())
                 .collect();
-            let cleanup_allowed = !args.preserve_state && !aborted && !vendor_corrupt;
+            // A global run keeps the project's vendored records too: their
+            // vendored state is not unwound, so dropping them would hand a
+            // later `vendor` reconcile a revert with no backing record. An
+            // unreadable ledger leaves that ownership unknowable either way.
+            let cleanup_allowed = !args.preserve_state && !aborted && !ledger_unreadable;
             // A vendor-owned manifest purl is removable only when its
             // ledger entry was cleanly reverted this run (drift-keeps and
             // failures keep the record; the matching mirrors the
@@ -1588,6 +1624,9 @@ pub async fn run(args: RollbackArgs) -> i32 {
                     if failed_purls.contains(*purl) {
                         return false;
                     }
+                    if !project_state && purl_keys_cover(&project_vendored_keys, purl) {
+                        return false;
+                    }
                     if vendored_excluded.contains(purl) {
                         return vendored_reverted_ok(purl);
                     }