refactor: run 20261009T101429Z (#1258, #1227 merged)

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

doc/04-js-lockfiles.md

@@ -93,7 +93,7 @@ The question "which lockfile drives installs?" was answered in **at least eight
 - npm_lock keeps the file's layout through `JsonLayout` (#357), and so does vendored pnpm's `package.json` writer (#810, {{E53}});
 - vlt has its own `strip_cr`.
 
-Five different answers to one question, and every one of them is a bug class (see the open-issue appendix). Across the whole crate there are five terminator rules (any-CRLF, first line, majority, CRLF-only re-expansion, refuse); since #1108, seven inserted-line sites pick through `utils::line_endings::terminator` (CRLF only for a CRLF file, the majority for a mixed one), while the any-CRLF rule is still written in `common::detect_eol`, a byte-identical `pypi_uv::newline_of` and inline copies (`maven_reactor.rs` ×2, upstream gem, the hosted Gemfile edit), and `gradle::newline_of` uses the first-line rule under the same name. A probe on `045d7ec` gives three answers for one mixed input. {{E16}}
+Five different answers to one question, and every one of them is a bug class (see the open-issue appendix). Across the whole crate there are five terminator rules (any-CRLF, first line, majority, CRLF-only re-expansion, refuse); since #1108, seven inserted-line sites pick through `utils::line_endings::terminator` (CRLF only for a CRLF file, the majority for a mixed one), and since #1227 the vendored `common` and `pypi_uv` writers and the `.npmrc` splice do too (`detect_eol` and `pypi_uv::newline_of` are gone), while the any-CRLF rule is still written inline in `maven_reactor.rs` (×2), upstream gem and the hosted Gemfile edit, and `gradle::newline_of` uses the first-line rule under the same name. A probe on `045d7ec` gives three answers for one mixed input. {{E16}}
 
 ### 4.5 Architecture defects
 

doc/05-vendored.md

@@ -158,7 +158,7 @@ Revert/restore/unwind code in the non-npm backends totals **about 3,540 lines**:
   - `utils/lock_fragments` (Poetry and PDM) re-terminates spliced lines with `majority_terminator` (#703) {{E54}};
   - `cargo_manifest` aligns lines with an LCS diff.
 
-  There are also ad-hoc helpers in four more files: on main, `common::detect_eol`, `pypi_uv::newline_of` and `gradle::newline_of` (a different, first-line rule under the same name), plus inline any-CRLF copies in `maven_reactor.rs` (×2) and `pypi_pipenv.rs`. One classifier is the target. {{E16}}
+  Since #1227, `common` and `pypi_uv` pick through `utils::line_endings::terminator` (`detect_eol` and `pypi_uv::newline_of` are gone). Ad-hoc rules remain in `gradle::newline_of` (a different, first-line rule) plus inline any-CRLF copies in `maven_reactor.rs` (×2) and `pypi_pipenv.rs`. One classifier is the target. {{E16}}
 - **Per-backend copies:**
   - `cleanup_failed_stage` is byte-identical in cargo and gem, and one line different in composer; golang has its own `cleanup_failed_service_stage`.
   - `<eco>_service_copy` (fetch → settle → claim_prestaged-or-extract → afterHash check → swap) is repeated for cargo, composer, gem and golang (`go_service_redirect`): about 500 lines, with the layout-mismatch message spelled four times. No drift proven yet. {{E25}}

entries/refactor/20261009T101429Z.md

@@ -0,0 +1,9 @@
+[agent] 2026-10-09: architecture refactor run
+
+- main: `a80b89e` (was `f6a9fea`).
+- Merged since the last entry: #1227 (E16 slice 2: `common::detect_eol`, `pypi_uv::newline_of` and the `.npmrc` splice through `line_endings::terminator`). Register: E16 → partly fixed (#1108, #1227). Doc passages rewritten: 04 line-ending paragraph (`detect_eol`/`newline_of` gone, inline any-CRLF copies remain in `maven_reactor.rs`, upstream gem and the hosted Gemfile edit) and 05 line-ending helpers bullet.
+- Ranking: 17 agent PRs change 294 files. The manifest-load cluster, #717, #1220 (its `join_all` sites in upstream cargo/pypi/composer/npm are all changed by open PRs), #675, #705, #794, #594 and #757 are all skipped by file overlap. #824 children 2–3 slice 2 (56 test-helper copies, R L) won among free files; the free production rows (E64 BOM in two files, E37, #833 `vlt_lock_text.rs` move) are D ≈1.
+- PR: [#1258](https://github.com/SocketDev/socket-patch/pull/1258), `state: ready`, Bugbot requested. Tests +142/−401, production 0. 40 files drop private `binary()` (31) / `git_sha256` (25); the two pnpm build suites keep their env override as `socket_bin()`. Clippy clean; all touched targets pass except the 2 known root-only `repair` lock tests.
+- Claimed: #824 (slice; `Refs`, tracker stays open). Released: none.
+- Register: C30 → slice 2 in PR #1258; `doc/08` already carries `{{C30}}`.
+- Lessons: a scripted removal of a helper leaves `use sha2::{Digest, Sha256}` for `cargo fix --allow-dirty` to trim to `use sha2::Digest;`, which then warns in a second pass; run the build twice. rustfmt with `--config skip_children=true` on `git show origin/main:<file>` piped through stdin tells whether `main`'s copy is clean without tripping over `#[path]` modules.

register/10-audit-ecosystems.md

@@ -17,7 +17,7 @@ _Last updated 2026-10-09T06:49Z · main @ f3c6313_
 | E13 | 2 | `poetry_lock.rs` ≈ `pdm_lock.rs`. | 5.4 | #694 | fixed (#703) |
 | E14 | 2 | Pipfile.lock is written two ways: vendored mode re-serializes the whole lock (loses `\uXXXX` escapes, refuses a BOM), while hosted mode splices spans (executed twice). | 5.4 | #1128 | in PR #1188 (one `formats::pipenv` entry splicer for hosted, upstream restore and vendored) |
 | E15 | 2 | Cargo.toml `[package]` is read five ways and has drifted on BOM, `[project]` and dotted keys; hosted `plan_cargo_toml` refuses a multi-line `features` array (merged E57). | 5.4; 3.7 #3 | #693, #757 | partly fixed (#1110); `vendor/cargo.rs` `path_crate_version` and hosted `plan_cargo_toml` (#757) remain |
-| E16 | 2 | CRLF has five npm-family policies and three for `toml_edit` output; the "any `\r\n` → CRLF" rule is written 14 times (merged E60). | 4.4; new finding | #814, #815 | partly fixed (#1108, 7 sites); in PR #1227 (slice 2); `maven_reactor.rs`, upstream gem, hosted Gemfile and Gradle first-line rule remain; tracking #814 |
+| E16 | 2 | CRLF has five npm-family policies and three for `toml_edit` output; the "any `\r\n` → CRLF" rule is written 14 times (merged E60). | 4.4; new finding | #814, #815 | partly fixed (#1108, 7 sites; #1227, slice 2); `maven_reactor.rs`, upstream gem, hosted Gemfile and Gradle first-line rule remain; tracking #814 |
 | E17 | 2 | "Is a bun lock present" is asked at seven sites with three semantics (lstat, `exists`, `is_file`). With a dangling `bun.lock` symlink, Bun and the writers use `bun.lockb`, but the inventory returns nothing. | 4.4 | #735 | in PR #1009 |
 | E18 | 3 | JS helper copies: JSON-pointer escape ×2, wiring lines↔JSON ×3, `name@spec` split ×2, `KIND_*` re-spelled, uneven recursion bounds, regexes compiled per dependency. | 4.4 | #835 | rejected; closed not planned 2026-10-08 (maintenance-only) |
 | E19 | 3 | Gem has three section models and three DEPENDENCIES-name parsers (vendored sees only the first `GEM` section, #779). Go's `module` readers fixed (#870). | 5.4 | #780, #781 | filed #780; partly fixed (#1221, hosted slice); vendored `vendor/gem.rs` models open |

register/20-audit-core.md

@@ -32,7 +32,7 @@ _Last updated 2026-10-09T09:55Z · main @ a80b89e_
 | C27 | 3 | Agent mode wrote no Maven sidecars. | 7.4 | #551 | already fixed (#646) |
 | C28 | 3 | socket.yml builds a hand-made YAML tree to read 8 keys. | 7.5 | | rejected; the tree implements the contract's scoped YAML refusals |
 | C29 | 3 | The `client.rs` split (2.8K lines) into client, vendor_service and credentials; the debug-ordering machinery (`HeldBack`) has 45 call sites. | 7.2; 7.6 #8 | #913 | filed #913; #871 deferred (closed not planned) |
-| C30 | 2 | No shared test-support: `binary()` is defined in 103 files and `git_sha256` in 86, there are 15 `scrub_socket_env` (14 bodies), xorshift is implemented four times, and the VEX helpers are forked. | 6.4; 8.5 D | #824, #823 | filed #824, #823; #850 deleted 8 of 15 `scrub_socket_env`; #824 children 2–3 fixed (#1124) |
+| C30 | 2 | No shared test-support: `binary()` is defined in 103 files and `git_sha256` in 86, there are 15 `scrub_socket_env` (14 bodies), xorshift is implemented four times, and the VEX helpers are forked. | 6.4; 8.5 D | #824, #823 | filed #824, #823; #850 deleted 8 of 15 `scrub_socket_env`; #824 children 2–3 partly fixed (#1124); slice 2 in PR #1258 |
 | C31 | 3 | 240 test executables on `f3c6313` (review: 207); target ~25. Needs C10 first. | 8.5 A |  | to verify; count confirmed, not filed: blocked on #794 (env-mutating `#[serial]`) |
 | C32 | 3 | Tracking: ~478 one-line 4+-word `.contains` sentence assertions (245 in the 27 covgap files, 26,086 lines, 391 tests on `05ecc6e`) become `--json`/`errorCode` checks plus render suites; `_json`/`_human` twins collapse. | 2.5; 8.5 G/H | #1089 | filed #1089; tracking #1089 (#1090 folded in) |
 | C33 | 3 | Tracking: `CLI_CONTRACT.md` (417 KB on `431b818`; 332 KB at review) should be a checked reference (flags, env vars, codes, exit codes) plus ≤300 lines of prose, with freshness tests. | 8.3; 8.5 F/I | #948 | filed #948; tracking #948 (#949, #678 folded in) |

register/90-refactor.md

@@ -1,28 +1,28 @@
 ### Refactor routine (`refactor`, hourly, highest leverage first)
-_Last updated 2026-10-09T09:15Z · main @ f6a9fea_
+_Last updated 2026-10-09T10:15Z · main @ a80b89e_
 
 **In flight:**
-- [#1253](https://github.com/SocketDev/socket-patch/pull/1253): agent-mode `jvm_jar::verify_member_bytes` streams members through `hash::git_sha256::zip_member_git_sha256` (302 → 30 MiB peak on a 256 MiB member). #914 slice (C51); `vendor/common.rs` caller waits for #1227. +17/−11 prod, +85 tests. `state: ready`.
+- [#1258](https://github.com/SocketDev/socket-patch/pull/1258): 40 more CLI test files import `tests/common`'s `binary()` / `git_sha256` (31 + 25 copies deleted). #824 children 2–3 slice 2 (C30). +142/−401 tests, 0 prod. `state: ready`.
+- [#1253](https://github.com/SocketDev/socket-patch/pull/1253): agent-mode `jvm_jar::verify_member_bytes` streams members through `hash::git_sha256::zip_member_git_sha256` (302 → 30 MiB peak on a 256 MiB member). #914 slice (C51); `vendor/common.rs` caller is free since #1227 merged; it needs #1253's helper. +17/−11 prod, +85 tests. `state: ready`.
 - [#1245](https://github.com/SocketDev/socket-patch/pull/1245): `vendor::revert::finish` + `KeepPolicy` (`OnDrift`, `OnDriftWhileReferenced`, `NpmFamily`); gem, composer, Maven legacy, NuGet and pnpm finish through it. #989 item 1 slice (E24). +133/−157 prod (helper 90), +271 tests. `state: ready`.
 - [#1239](https://github.com/SocketDev/socket-patch/pull/1239): NuGet crawler `find_by_purls` looks up the global folder and legacy `<Id>.<Version>/` folders by the normalized version (`1.0.0.0` = `1.0.0`) through `normalize_nuget_version`. #1202 crawler slice (E93). +47/−19 prod, +116/−4 tests. `state: ready`.
-- [#1227](https://github.com/SocketDev/socket-patch/pull/1227): `common::detect_eol`, `pypi_uv::newline_of` and the `.npmrc` splice through `line_endings::terminator`. #815 slice 2 (E16). +25/−44 prod, +93 tests; golang golden re-blessed (mixed go.sum inputs only). `state: ready`.
 - [#1188](https://github.com/SocketDev/socket-patch/pull/1188): one `Pipfile.lock` writer (`formats::pipenv::splice_entry`, `formats::json`). Issue #1128 (E14). +303/−235 production. `redirect/mod.rs` wrapper `pipenv_reserialized_around_reference` left for when that file is free. `state: ready`.
 - [#1126](https://github.com/SocketDev/socket-patch/pull/1126): 7 inline purl-type checks through `Ecosystem::from_purl` + guard. Issue #747 (C20, slice 1). `state: ready`.
 - Maintainer drafts (decided issues): #1049 (#792). #1036 (#973), #1041 (#648), #1027, #1030, #1031 and #1051 merged.
 
-**Merged:** #1221 (E19 hosted gem sections, +213/−140 prod), #1230 (E93 `PurlKey`, +37/−7 prod), #1217 (E05 Deno crawl, +108/−43 prod), #1209 (E05 Go crawl, +132/−44 prod), #1205 (E05 cargo crawl), #1183 (E05 NuGet crawl); earlier #1191, #1185, #1103, #1108, #1163, #1160, #1153, #1151, #1145, #1141, #1106, #1110, #1117, #1121, #1124, #1021, #1015, #889, #876, #886, #870, #865, #858, #850, #607, #602, #597, #587, #583, #581, #574, #572 (see `entries/refactor/`). Leftovers: `blob_hash_matches` (#1163), dead `eco == "maven2"` arm in `commands/vendor.rs` (#1015).
+**Merged:** #1227 (E16 slice 2, +25/−44 prod), #1221 (E19 hosted gem sections, +213/−140 prod), #1230 (E93 `PurlKey`, +37/−7 prod), #1217 (E05 Deno crawl, +108/−43 prod), #1209 (E05 Go crawl, +132/−44 prod), #1205 (E05 cargo crawl), #1183 (E05 NuGet crawl); 32 earlier PRs (#572 … #1191, see `entries/refactor/`). Leftovers: `blob_hash_matches` (#1163), dead `eco == "maven2"` arm in `commands/vendor.rs` (#1015).
 
 **Queue** (B bugs closed, U unblocks, D duplication removed, R risk; score = 3B + 2U + 2D + S − risk). Since the 2026-10-08 backlog review, standalone refactor issues are closed as `not_planned` and kept as checklist items of their tracker; rank the tracker's next unchecked item.
 
 | # | Candidate | B | U | D | R | Score | Note |
 |---|---|:-:|:-:|:-:|:-:|:-:|---|
 | 1 | #989 item 1: one `vendor::revert::finish` for the 12 copied finish blocks | 0 | 1 | ≈12 | L | ≈26 | **taken: #1245**; bun ×2 (#1009), npm (#1161, #1187), vlt (#1161), pypi (#1026), yarn classic (#1242) and berry remain |
 | 2 | #931 + #998 + #1063 + #1123: one manifest load + error mapper for every command | 4 | 1 | ≈6 | M | ≈24 | skipped: `apply.rs`, `vendor.rs`, `rollback.rs` (#1009, #1049), `remove.rs` (#1034, #1049), `repair.rs` (#1049) |
-| 3 | #717 (E10): hosted pom edits + restore through `formats::maven` | 3 | 1 | ≈4 | M | ≈17 | skipped: `redirect/mod.rs` (#1009, #1026, #1180, #1242) |
-| 4 | #1220 (C78): bound upstream-restore fan-out through `utils::concurrent::registry_concurrency` | 1 | 0 | ≈4 | L | ≈11 | skipped: `upstream/mod.rs` (#1009, #1211), `concurrent.rs` (#1026) |
-| 5 | #914 (C51): agent-mode jar members through the streaming zip hasher | 0 | 0 | ≈1 | L | ≈7 | **taken: #1253** (`jvm_jar.rs`); `vendor/common.rs` caller after #1227 |
+| 3 | #717 (E10): hosted pom edits + restore through `formats::maven` | 3 | 1 | ≈4 | M | ≈17 | skipped: `redirect/mod.rs` (#1009, #1026, #1180, #1242, #1254) |
+| 4 | #1220 (C78): bound upstream-restore fan-out through `utils::concurrent::registry_concurrency` | 1 | 0 | ≈4 | L | ≈11 | skipped: the `join_all` sites in upstream `cargo.rs` (#1254), `pypi.rs` (#1188), `composer.rs` (#1026), `npm.rs` (#1009); `upstream/mod.rs` (#1009, #1211) |
+| 5 | #824 children 2–3 slice 2 (C30): 56 test-helper copies onto `tests/common` | 0 | 0 | 56 test | L | test-only | **taken: #1258**; 27 files changed by open PRs + 4 shared modules remain |
 
-Re-ranked 2026-10-09T09:00Z at `f6a9fea` against 29 open PRs changing 392 files (#1221 merged; #780 vendored slice waits on `vendor/gem.rs`, #1245/#1026; claim released). #1098 (E90) still needs `ecosystem_dispatch.rs`/`vex_consumed.rs` (#1009, #1026, #1034). #1202 `formats::nuget` move is free now (D 1). Free but lower: #1014 (`.mill-version` needs a decision), #265 Maven crawl (risk H), E37 (composer `normalize_version` ≡ `strip_leading_v`, D 1).
+Re-ranked 2026-10-09T10:00Z at `a80b89e` against 27 open PRs (17 agent PRs change 294 files). #1227 merged and frees `vendor/common.rs` for #914's last caller, but that needs #1253's helper first. Also skipped: #675 (`scan/mod.rs` #1049/#1211, `client.rs` #1026/#1034/#1049), #705 (`client.rs`, CLI `lib.rs` #1034), #794 (command files), #594/#1202 move (`nuget_feed.rs` #1245, `redirect/mod.rs`), #757/E15 (`redirect/mod.rs`, `vendor/cargo.rs` #1026), #782 remainder (`state.rs`, `wired.rs` #1009/#1034). Free but low: E64 BOM in `formats/pnpm/lines.rs`, `vex/discover/pypi_other.rs` (D ≈1 each), E37, #833 `vlt_lock_text.rs` move.
 
 **Notes:**
 - Revert finish (#1245): new backends end their revert with `revert::finish(outcome, root, rel, opts, KeepPolicy::…)`; the npm family keeps its bare `cannot remove <rel>` failure (warnings dropped), the rest keep warnings with `failed to remove <abs>`. Yarn berry/classic and npm add a still-wired refusal before the delete: extend the policy, do not re-copy the sequence.
@@ -35,7 +35,6 @@ Re-ranked 2026-10-09T09:00Z at `f6a9fea` against 29 open PRs changing 392 files
 - Cargo crawl scope (#1205): only a registry cache with a parseable `<cwd>/Cargo.lock` is scoped. "Only the crawl vouches" tests put the crate in `vendor/`. Narrowing a crawl changes `scan --prune`: say so in the PR.
 - `Pipfile.lock` edits go through `formats::pipenv::splice_entry` since #1188: sort the value (`sort_all_objects`) before splicing; never re-serialize the whole lock.
 - NuGet crawl scope (#1183): only a `cwd` with a project file is scoped; a solution root keeps the walk (restores at any depth). Extend through `PackageRoots::scope`, not a second assets reader.
-- Poetry 2.x `files` is written one file per line by the shared engine since #1185; a test or golden that greps `files = [{ file` only sees 1.0/1.1 package-level `files` now.
 - A hash read from a manifest is lowercase after #1163; `api::blob_fetcher::blob_hash_matches` and vendored `eq_ignore_ascii_case` sites become plain `==` once their files are free (#707 remainder).
 - `formats::xml` (#1145) is the shared XML element scanner (comment + CDATA blanking, `elements`, `children`, `attr`); route new XML readers (NuGet, pom writers) through it instead of a private masker.
 - The skip rule names `arch-refactor/*` and `agent/fix-*` PRs only; still check `arch-fix/*` and `ci*` hunks before touching the same lines.