@@ -0,0 +1,38 @@
+[agent] 2026-09-30 (run 2): Go modules bug-hunt run
+
+**Tested:** main `f6b7fb9`, unchanged since run 1 (CLI 4.0.0), and the 4.0.0 GitHub release binary (linux musl) for comparison. Toolchain: go 1.24.7 (Linux only). This run needed no probe branches: all three findings come from go.mod/go.work text logic, which doesn't depend on the OS.
+
+**Setup:** the same hermetic file GOPROXY + temp GOMODCACHE + hand-staged `.socket/manifest.json` and blob (the `tests/e2e_golang_build.rs` shape), extended with upstream v1.0.0/v1.0.1/v1.1.0 and the intermediate modules `mida` → upstream v1.0.0 and `midb` → upstream v1.0.1. The oracle is the real `go build` / `go run`.
+
+## Re-triage
+- #343, #344, #346: main is unchanged (`f6b7fb9`), so all three are still open and no fix PR exists. Nothing to close.
+
+## Cells
+- **Agent upgrade drift → VEX** (`go get M@v1.0.1` / `@v1.1.0` after apply): **fail → #391**. The binary is PRISTINE and `apply --check` exits 1, but `vex` exits 0 with `not_affected`. Reproduced 3× on main, plus on 4.0.0 (4.0.0 needs `--product`).
+- **Transitive MVS selection, go 1.16 go.mod** (the graph selects upstream v1.0.1; v1.0.0 is also cached and patched): **fail → #392**. `apply` exits 0 and reports it applied, `--check` says in sync, `vex` gives `not_affected`, and the binary is PRISTINE. Same on 4.0.0.
+- **Same graph with a go 1.21 go.mod:** `apply` exits 0 and reports it applied, and its own `--check` then flags drift. The VEX leak is #391; the apply part is covered in #392.
+- **Project that doesn't depend on the patched module** (only cached): `apply` exits 0 and writes a replace into the unrelated go.mod. Covered in #392.
+- **go.work user replace (`M v1.0.0 => ../fork`, `M => ../fork`):** **fail → #393**. Agent `apply` and vendored `vendor` both exit 0, the build links FORK, `--check` says in sync, and VEX gives `not_affected` (`(vendored)` in vendored mode). The same line in go.mod is correctly refused.
+- **go.mod with a `replace ( … )` block, `exclude`, `retract`, `toolchain`, and comments:** pass (apply, build PATCHED, `--check`, byte-exact rollback).
+- **`GOFLAGS=-mod=readonly` build after apply:** pass.
+- **Idempotent re-apply and `go mod tidy` after apply:** pass (go.mod md5 unchanged).
+- **`remove <purl> -y`:** pass (go.mod restored, build PRISTINE, blob GC'd).
+
+## Issues
+- Filed #391: https://github.com/SocketDev/socket-patch/issues/391 (VEX ignores upgrade drift)
+- Filed #392: https://github.com/SocketDev/socket-patch/issues/392 (apply redirects a version the build graph doesn't select; go ≤1.16 hides it from check/VEX)
+- Filed #393: https://github.com/SocketDev/socket-patch/issues/393 (a go.work user replace overrides the Socket replace)
+
+## False positives ruled out
+- The workspace build failing with `-mod may only be set to readonly or vendor when in workspace mode` came from my fixture's `GOFLAGS=-mod=mod`, not from socket-patch. Re-ran with `GOFLAGS=` unset.
+- `remove --yes` isn't a flag (`-y` is), so the first remove attempt was a CLI usage error and not a bug.
+
+## Probe branches
+None were pushed. Run 1's three stale probe branches still need a maintainer to delete them, because `git push --delete` got a 403 then.
+
+## Next
+1. Hosted mode via the wiremock harness (`e2e_golang_hosted_build.rs`) × go.work user replace (#393 variant), upgrade drift, `/v2`, `+incompatible`, CRLF/BOM go.sum.
+2. Toolchain matrix for #391/#392/#393 on 1.16 (no go.work there), 1.18, 1.21 and 1.26 via a probe branch, if the branches can be deleted afterwards.
+3. `GOFLAGS=-mod=vendor` in the env or GOENV, and a committed `vendor/` together with go.work (`go work vendor`, 1.22+).
+4. go.work root without a root go.mod: decide whether it's a limitation or a bug (still "matched no installed package").
+5. Windows cells once #346 is fixed.
@@ -1,34 +1,35 @@
 [agent] Progress ledger for the scheduled Go modules bug-hunt routine (label pm:go).
 
-Last updated: 2026-09-30 (run 1), main `f6b7fb9` (CLI 4.0.0), latest release 4.0.0 (previous 3.3.0).
+Last updated: 2026-09-30 (run 2), main `f6b7fb9` (CLI 4.0.0), latest release 4.0.0 (previous 3.3.0).
 
 ## Coverage matrix
 
 Cells are "pass", "fail #N" or "untested". Every cell uses a real `go build`/`go run` against a hermetic file GOPROXY and a hand-staged `.socket/manifest.json` plus blob (the `tests/e2e_golang_build.rs` shape). Hosted mode needs the wiremock harness (`e2e_golang_hosted_build.rs`) and hasn't been exercised by this routine yet.
 
-| OS | go | Agent `apply` (plain) | Agent edge shapes (uppercase, /v2, pseudo, gopkg.in, CRLF, tidy, idempotent, rollback) | Vendored `vendor` (plain) | Committed `vendor/` dir | `go env -w` settings | Upgrade drift → VEX | Hosted |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| Linux | 1.16.15 | untested | untested | untested | fail #343 | fail #344 | untested | untested |
-| Linux | 1.21.13 | pass (probe) | untested | pass (probe) | fail #343 | fail #344 | untested | untested |
-| Linux | 1.24.7 | pass | pass | pass | fail #343 | fail #344 | fail (agent attests; not filed yet, backlog 1) / vendored pass | untested |
-| Linux | 1.26.3 | pass (probe) | untested | pass (probe) | fail #343 | fail #344 | untested | untested |
-| macOS | 1.24.13 / 1.26.3 | untested (plain; the vendor/-dir cell got as far as apply exit 0) | untested | untested | fail #343 | fail #344 | untested | untested |
-| Windows | 1.16.15 / 1.21.13 / 1.26.3 | fail #346 | blocked by #346 | fail #346 | blocked by #346 | fail #344 | untested | untested |
+| OS | go | Agent `apply` (plain) | Agent edge shapes (uppercase, /v2, pseudo, gopkg.in, CRLF, replace block/exclude/retract/toolchain, tidy, idempotent, rollback, remove) | Vendored `vendor` (plain) | Committed `vendor/` dir | `go env -w` settings | Upgrade drift → VEX | Transitive / unselected version | go.work user replace | Hosted |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| Linux | 1.16.15 | untested | untested | untested | fail #343 | fail #344 | untested | untested | n/a (no go.work) | untested |
+| Linux | 1.21.13 | pass (probe) | untested | pass (probe) | fail #343 | fail #344 | untested | untested | untested | untested |
+| Linux | 1.24.7 | pass | pass | pass | fail #343 | fail #344 | fail #391 (agent) / vendored pass | fail #392 | fail #393 (agent + vendored) | untested |
+| Linux | 1.26.3 | pass (probe) | untested | pass (probe) | fail #343 | fail #344 | untested | untested | untested | untested |
+| macOS | 1.24.13 / 1.26.3 | untested (plain; the vendor/-dir cell got as far as apply exit 0) | untested | untested | fail #343 | fail #344 | untested | untested | untested | untested |
+| Windows | 1.16.15 / 1.21.13 / 1.26.3 | fail #346 | blocked by #346 | fail #346 | blocked by #346 | fail #344 | blocked by #346 | blocked by #346 | blocked by #346 | untested |
 
 ## Backlog
 
 0. Delete stale probe branches `bughunt/go/20260930-goenv-vendor`, `bughunt/go/20260930-windows-apply` and `bughunt/go/20260930-windows-bisect`: `git push --delete` gets HTTP 403 from the git proxy.
-1. File: agent-mode `vex` attests `not_affected` for an inert `.socket/go-patches` replace after `go get` upgrade drift, while `apply --check` flags `ResolvedVersionMismatch` (see `vex.rs:1333` `synthesize_go_patches`; the repro is in the 2026-09-30 entry).
-2. A go.work root without a root go.mod: `apply` fails with "matched no installed package". Decide between limitation and bug, and check the docs.
-3. Hosted mode: committed `vendor/`, `/v2` and `+incompatible` originals, CRLF/BOM go.sum, `go.work.sum`.
-4. `GOFLAGS=-mod=vendor` in the env, `retract`, `exclude` directives, `toolchain` lines, and a go 1.21+ `go` directive with GOTOOLCHAIN auto.
-5. Windows cells once #346 is fixed (long paths, CRLF checkouts).
+1. Hosted mode (wiremock harness) × go.work user replace, upgrade drift, `/v2`, `+incompatible`, CRLF/BOM go.sum, `go.work.sum`.
+2. Toolchain matrix (1.18 / 1.21 / 1.26) for #391, #392 and #393 via a probe branch, once branch deletion works.
+3. `GOFLAGS=-mod=vendor` in the env or GOENV; `go work vendor` (1.22+) with a committed vendor/.
+4. go.work root without a root go.mod: `apply` fails with "matched no installed package". Decide between limitation and bug.
+5. Windows cells once #346 is fixed (long paths, CRLF checkouts, drive-letter replace targets).
 
 ## Known non-bugs
 
 - `patches-api.socket.dev` is blocked by the sandbox proxy. Stage `.socket/manifest.json` plus blobs locally. `proxy.golang.org` IS reachable from the sandbox.
-- 3.3.0 rejects the hand-staged manifest shape (`apply` exit 1), so it can't be compared on these cells.
-- `apply` refuses (exit 1) when go.mod has a user-authored `replace M => …` for the patched module: intended.
+- 3.3.0 rejects the hand-staged manifest shape (`apply` exit 1), so it can't be compared on these cells. 4.0.0 `vex` needs an explicit `--product` in these fixtures (there's no git remote).
+- `apply` refuses (exit 1) when go.mod has a user-authored `replace M => …` for the patched module: intended. (The same line in go.work is NOT refused, which is #393.)
 - Agent-mode `repair` doesn't rebuild a deleted `.socket/go-patches/` copy. `repair --help` scopes rebuilding to vendored artifacts; re-run `apply`.
 - `go ... -modcacherw` leaves cache FILES read-only (directories only), so it's not a workaround for #346.
 - With manifest deleted, agent-mode go-patches redirects are not attestable (`manifest_not_found`): documented in `e2e_golang_build.rs`.
+- Workspace mode rejects `GOFLAGS=-mod=mod` (a go restriction); unset GOFLAGS in go.work fixtures.