Keep an older vendored patch only while its wiring is still live

When a superseding patch's prebuilt artifact is pending or unavailable,
the vendor run kept the older vendored patch as a benign skip whenever
the ledger held a different uuid. After a relock dropped the
file:.socket/vendor/... reference, that turned an unpatched package into
exit 0 claiming the old patch was kept. Gate the keep on the same
Discovery::vendor_entry_live verdict vendor --check and vex use, so an
unwired older entry leaves the unserved upgrade a failure.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

crates/socket-patch-cli/src/commands/vendor.rs

@@ -124,13 +124,20 @@ fn refusal_is_benign(code: &str) -> bool {
 /// older vendoring is still in force: like hosted mode, which keeps its pin
 /// and skips the upgrade, the package is a benign skip under the unserved
 /// code instead of a failure that would fail every re-run until the server
-/// builds the artifact. Any other outcome passes through, a failure minus
-/// the unserved marker (its error already says it).
-fn keep_older_vendored_patch(
+/// builds the artifact. Only an older vendoring whose wiring is still live
+/// (the [`Discovery::vendor_entry_live`] verdict `vendor --check` and `vex`
+/// use) is in force: once a relock dropped its `.socket/vendor/` reference
+/// the package is patched in neither mode, so the unserved upgrade stays a
+/// failure. Any other outcome passes through, a failure minus the unserved
+/// marker (its error already says it).
+///
+/// [`Discovery::vendor_entry_live`]: socket_patch_core::vex::discover::Discovery::vendor_entry_live
+async fn keep_older_vendored_patch(
     outcome: Option<VendorOutcome>,
     state: &VendorState,
     purl: &str,
     uuid: &str,
+    common: &GlobalArgs,
 ) -> Option<VendorOutcome> {
     let Some(VendorOutcome::Done {
         result,
@@ -149,6 +156,18 @@ fn keep_older_vendored_patch(
         }) {
             let unserved = warnings.remove(i);
             if let Some(kept) = lookup_entry(&state.entries, purl).filter(|e| e.uuid != uuid) {
+                let root = common.project_root();
+                if !crate::commands::discover_wiring(common, &root)
+                    .await
+                    .vendor_entry_live(&root, kept)
+                    .await
+                {
+                    return Some(VendorOutcome::Done {
+                        result,
+                        entry,
+                        warnings,
+                    });
+                }
                 return Some(VendorOutcome::Refused {
                     code: unserved.code,
                     detail: format!(
@@ -3376,7 +3395,8 @@ pub(crate) async fn vendor_records_reusing(
                 }
             }
 
-            let outcome = keep_older_vendored_patch(outcome, &state, candidate, &record.uuid);
+            let outcome =
+                keep_older_vendored_patch(outcome, &state, candidate, &record.uuid, common).await;
             match outcome {
                 None => {
                     env.record(

crates/socket-patch-cli/tests/in_process_vendor.rs

@@ -852,6 +852,66 @@ async fn superseding_patch_without_a_served_artifact_keeps_the_vendored_one() {
     }
 }
 
+/// The #954 skip keeps only an older vendoring that is still wired: once a
+/// relock dropped its `file:.socket/vendor/...` reference the package is
+/// patched in neither mode, so the unserved upgrade still fails (the
+/// `vendor --check` liveness verdict) instead of claiming the old patch.
+#[tokio::test]
+async fn superseding_patch_without_a_served_artifact_fails_when_the_old_one_is_unwired() {
+    use wiremock::matchers::{method, path_regex};
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+    const UUID2: &str = "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d";
+    let fx = npm_fixture();
+    assert_eq!(vendor_run(vendor_args(fx.root())).await, 0);
+    // A relock: the lock no longer references the vendored artifact.
+    std::fs::write(fx.lock_path(), &fx.original_lock).unwrap();
+
+    let mut manifest: Value =
+        serde_json::from_slice(&std::fs::read(fx.manifest_path()).unwrap()).unwrap();
+    manifest["patches"][PURL]["uuid"] = json!(UUID2);
+    std::fs::write(
+        fx.manifest_path(),
+        serde_json::to_vec_pretty(&manifest).unwrap(),
+    )
+    .unwrap();
+
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path_regex(r"/(patch|patches)/package$"))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .set_body_json(json!({ "results": { UUID2: { "status": "pending_build" } } })),
+        )
+        .mount(&server)
+        .await;
+    let uri = server.uri();
+    let (code, env) = vendor_cli(
+        fx.root(),
+        &[
+            "--api-url",
+            &uri,
+            "--vendor-url",
+            &uri,
+            "--api-token",
+            "sktsec_placeholder_value_for_tests_api",
+            "--org",
+            "acme",
+            "--lock-timeout",
+            "5",
+        ],
+    );
+    assert_eq!(code, 1, "an unwired older patch is not kept: {env:#}");
+    let failed = find_event(&env, "failed", None);
+    assert_eq!(failed["purl"], PURL);
+    assert!(failed.to_string().contains("still building"), "{failed}");
+    assert!(
+        events(&env)
+            .iter()
+            .all(|e| e["errorCode"] != "vendor_prebuilt_pending"),
+        "no unserved marker leaks out of a real failure: {env:#}"
+    );
+}
+
 /// The #954 skip is only for a package vendored at ANOTHER patch: a first
 /// vendor whose artifact is still building has nothing to keep and fails.
 #[tokio::test]