@@ -0,0 +1,17 @@
+[agent] 2026-10-02T21:25Z: architecture refactor run
+
+**main:** `045d7ec`.
+
+**Ranking:** 2 of 3 slots were in use (#574, #602). The top three candidates (#568, #593, E37) change files that open PRs #598, #597 and #602 change. C07 was verified on `main`: with no org slug, the JSON routes use `/v0/orgs/default` while blob and vendor downloads use the public proxy. Unifying them needs an owner decision on which route wins (`covgap_api_client` pins `default`), so it was set aside. The best eligible candidate was #571 (C37): B 1, D 1 (the duplicate blob and diff download loops), R M, score 2.
+
+**PR:** [#607](https://github.com/SocketDev/socket-patch/pull/607), "Stream patch blob and diff downloads to disk (#571)". It is ready for review, with CI and Bugbot pending.
+- `fetch_blob` / `fetch_diff` return a `BinaryBody` stream.
+- `stream_cache_entry_atomic` stages each body chunk by chunk, hashes blobs from the staged file, and removes any cache directories it created when it fails.
+- One `download_entries` loop replaces the two.
+- The new streaming test fails on `main` and passes on the branch.
+
+**Claimed:** #571 (Claim-ID `20261002T205951Z-acffe9`).
+
+**Merged / living document:** #581 was recorded by the previous run. This run removed it from In flight in the register. C37 is now `in PR #607`, and its `{{C37}}` token is already in `doc/07-infra-agent.md`.
+
+**Lessons:** The skip rule holds even when another PR's hunks are far from the code you'd change (#598 edits `scan/hosted.rs` line ~731, while `vendored_takeover` is at ~1567). That candidate waits.
@@ -39,7 +39,7 @@ _Last updated 2026-10-02T16:20Z · main @ 1169ae6_
 | C34 | 3 | Decide: the command model. A read-only `scan`, plus `fix`, `undo`, `sync` and `check`, with mode inferred from project state. This folds `remove`, `rollback` and `vendor --revert`, and per-command flags replace the 27 globals. | §4; 2.9; R6/R8 | | to verify |
 | C35 | 3 | Decide: drop the deprecated spellings and embedded `--vex`, and give `SOCKET_FORCE` per-command names. | R9; R10 | | to verify |
 | C36 | 3 | Decide: the futures of agent mode and of the self-update binary swap. | §6 Q2; 7.5 | | to verify |
-| C37 | 2 | Patch blob/diff downloads (`fetch_binary`) buffer the whole body with no size cap; vendor and self-update use the shared `read_capped`. | new finding | #571 | filed #571 |
+| C37 | 2 | Patch blob/diff downloads (`fetch_binary`) buffer the whole body with no size cap; vendor and self-update use the shared `read_capped`. | new finding | #571 | in PR #607 |
 
 **Handed off** (to the CI janitor): report-only coverage and LTO `docker-base` off PRs; e2e from 148 to ~50 legs; a reusable compat workflow; no per-leg compiles; dead CI path filters (review 8.2, 8.5 B/C/E).
 
 
@@ -1,25 +1,26 @@
 ### Refactor routine (`refactor`, hourly, highest leverage first)
-_Last updated 2026-10-02T20:30Z · main @ b1f9818_
+_Last updated 2026-10-02T21:25Z · main @ 045d7ec_
 
 **In flight:**
 - [#574](https://github.com/SocketDev/socket-patch/pull/574): one vlt `registry_base` following vlt's DepID hydration. Issues #562 (E02, E03). State: ready (Ready for review). It awaits human approval.
-- [#581](https://github.com/SocketDev/socket-patch/pull/581): one `ApiTimeouts` policy (10 s connect, 60 s idle read) on both `ApiClient` reqwest clients. Issue #570 (C02). State: ready (Ready for review).
 - [#602](https://github.com/SocketDev/socket-patch/pull/602): crawler project-tree reads go through `utils::fs::read_regular_*`, plus a `crawlers::architecture_tests` guard against bare reads. Issue #592 (E06). State: ready, handed to the PR burn-down.
+- [#607](https://github.com/SocketDev/socket-patch/pull/607): blob and diff downloads stream to disk through `BinaryBody`; one `download_entries` loop replaces the blob and diff copies. Issue #571 (C37). State: ready for review, CI and Bugbot pending.
 
 **Merged:**
 - [#572](https://github.com/SocketDev/socket-patch/pull/572): one hosted-PyPI-URL recognizer for hosted and vendored Pipenv. Issues #563 (E04, E49). Production +31 / −48, tests +174 / −37 (approx.).
+- [#581](https://github.com/SocketDev/socket-patch/pull/581): one `ApiTimeouts` policy (10 s connect, 60 s idle read) on both `ApiClient` reqwest clients. Issue #570 (C02).
 
 **Queue** (B bugs closed, U unblocks, D duplication removed, R risk; score = 3B + 2U + D − risk):
 
 | # | Candidate | B | U | D | R | Score | Note |
 |---|---|:-:|:-:|:-:|:-:|:-:|---|
-| 1 | #568 (C03): takeover honors `kept_artifact` via `vendored_backend`'s revert step | 1 | 0 | 1 | L | 4 | skipped: `scan/hosted.rs` changed by open PR #598 (#503 merged) |
+| 1 | #568 (C03): takeover honors `kept_artifact` via `vendored_backend`'s revert step | 1 | 0 | 1 | L | 4 | skipped: `scan/hosted.rs` changed by open PR #598 |
 | 2 | #593 (E50): one version-aware `packages.lock.json` walker | 1 | 0 | 3 | M | 4 | skipped: `redirect/mod.rs` changed by open PR #597 |
-| 3 | E37: byte-identical `is_safe_{cargo,gem,nuget}_coordinate` + `normalize_version` copy | 0 | 0 | 4 | L | 4 | to verify, no issue; `vendor/cargo.rs` changed by open PR #598 |
-| 4 | #571 (C37): stream patch blob/diff downloads | 1 | 0 | 0 | M | 1 | maintainer steering: stream, no size caps |
-| 5 | #595 (E05 tracking): scope project-mode cache crawls | – | – | – | – | – | next slice not yet scored |
+| 3 | E37: byte-identical `is_safe_{cargo,gem,nuget}_coordinate` + `normalize_version` copy | 0 | 0 | 4 | L | 4 | to verify; `cargo_crawler.rs`/`nuget_crawler.rs` changed by open PR #602 |
+| 4 | C07: URL builders disagree on a missing org slug (`/v0/orgs/default` vs public proxy) | 1 | 0 | 3 | M | 4 | verified on 045d7ec; needs an owner decision on the fallback route (`covgap_api_client` pins `default`) |
+| 5 | C18: byte-identical UUID validators (`cli/lib.rs::looks_like_uuid`, `client.rs::is_valid_uuid`) | 0 | 0 | 1 | L | 1 | the `path_safety`/`apply.rs` grammars differ on purpose |
 
-Dropped: #594 (E11) now has open PR #597 (fixes #561, #585); #592 taken in #602.
+Taken: #571 (C37) in #607, score 2 (B1 D1 R M). Checked and set aside: E13 (`poetry_lock`/`pdm_lock`): the fragment walkers differ in real format handling, not just one shape check.
 
 **Notes:**
 - The sandbox runs as root, so 4 core lib tests fail on main and on branches alike: `copy_tree::relax_loop_must_not_traverse_symlinked_root`, `vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry`, `pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched`, `pypi_requirements::wire_failure_rolls_back_already_written_files`.
@@ -34,3 +35,5 @@ Dropped: #594 (E11) now has open PR #597 (fixes #561, #585); #592 taken in #602.
 - `rustfmt <file>` also formats that file's out-of-line child modules (formatting `crawlers/mod.rs` rewrote `python_crawler.rs`). Check `git diff --stat` after formatting and restore any file you didn't mean to touch.
 - `cargo clippy --all-targets` (and `-p socket-patch-core --tests`) already fails on `main` from older lints in test code. CI's gate is `cargo clippy --workspace --all-features -- -D warnings`.
 - Windows CI checks out with CRLF. A test that scans source text for `\n`-joined markers must normalize `\r\n` first: #602 failed `test (windows-latest)` this way.
+- reqwest 0.12 `Response::chunk()` streams without the `stream` feature. `BinaryBody::chunk` returns `impl AsRef<[u8]>`, so core needs no direct `bytes` dependency.
+- `cargo test -p socket-patch-cli --test repair` has 2 root-only failures (`repair_exits_zero_and_stays_quiet_when_lock_file_unremovable`, `repair_cleanup_failure_is_reported_in_json_and_silent_modes`). They chmod a directory read-only.