audit-ecosystems: run 20261009T065000Z (#1008 reconcile, E94 #1235)

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

doc/04-js-lockfiles.md

@@ -2,7 +2,7 @@
 
 ## Part 4: JavaScript lockfiles (npm, pnpm, yarn, bun, vlt)
 
-_Last checked against main @ cf8b164 on 2026-10-08 by audit-ecosystems (support-tier sizes for `bun.lockb`, pnpm 5.4/6.0 and vlt eras re-measured for E47). Earlier: `e2d9633` on 2026-10-08 by audit-ecosystems (4.1 `formats/yarn` contents and the 4.3 yarn rows after #1057); older checks are in the run entries. Owner: audit-ecosystems._
+_Last checked against main @ f3c6313 on 2026-10-09 by audit-ecosystems (the package-lock walk and the vendor driver after #1008). Earlier: `cf8b164` on 2026-10-08 by audit-ecosystems; older checks are in the run entries. Owner: audit-ecosystems._
 
 > Scope: `vendor/{npm_*,pnpm_*,yarn_*,bun_*,vlt_*,berry_zip}.rs`, `formats/{pnpm,yarn,bun,registry}`, `crawlers/npm_crawler*`, `vendor/lock_inventory/*`, `vex/discover/{npm,yarn,bun,vlt}.rs`, and the JS parts of `patch/redirect/` and `hosted/vlt.rs`. Line counts are production / inline-test, split at the first top-level `#[cfg(test)] mod`.
 
@@ -41,7 +41,7 @@ Shared npm-family infrastructure adds `npm_common.rs` 613/832, `npm_flavor.rs` 7
 
 | Format | Vendored writer | Hosted writer | Hosted restore | Inventory + VEX | `recover.rs` | Independent parsers |
 |---|---|---|---|---|---|---|
-| package-lock | `scan_lock_matches` :854, `rewrite_legacy_tree` :978 (serde `Value`, rendered with `JsonLayout` since #357) | `rewrite_one_npm_lock` :881, `rewrite_npm_v2_deps` :1095 (`serialize_json_like` → `JsonLayout`, #357) | `npm_lock_hits` :62, `v2_hits` :98 | `npm_lock_nodes` | full-object original :307 | **4 entry walks** {{E07}} |
+| package-lock | `scan_lock_matches` :854, `rewrite_legacy_tree` :978 (serde `Value`, rendered with `JsonLayout` since #357) | `rewrite_one_npm_lock` :881, `rewrite_npm_v2_deps` :1095 (`serialize_json_like` → `JsonLayout`, #357) | `npm_lock_hits` :62, `v2_hits` :98 | `npm_lock_nodes` | full-object original :307 | **1 entry walk**: `lock_inventory::npm::npm_lock_entries` serves inventory, vendored, hosted and restore (#1008) {{E07}} |
 | pnpm | `formats/pnpm/lines.rs` (`Vec<String>`, **refuses CRLF**) + own `LockIndex`/memo (446 lines) | `formats/pnpm/hosted.rs::plan_hosted` over `grammar.rs` (byte offsets, CRLF-aware) | `grammar.rs` | `grammar.rs` | shared | **2 grammars; 3 `resolution:` emitters** (`grammar.rs:164`, `pnpm_lock.rs:1992`, `pnpm_lock_legacy.rs:1137`) |
 | yarn classic | `formats::yarn::blocks` (`scan_blocks`, `repin_classic_block`) | same, spliced per block (#1057) | same | `scan_blocks` | ad-hoc `strip_prefix("integrity ")` | **1 block parser + 1 ad-hoc** |
 | yarn berry | `scan_blocks` + `berry_field` | `formats::yarn::stanzas` (re-keys and re-sorts entries) | `stanzas` | `berry_entries` | `inline_yaml_field` | **2 views of one grammar module + 1 ad-hoc; gates shared (#657)** |
@@ -62,9 +62,7 @@ The question "which lockfile drives installs?" was answered in **at least eight
 
 **pnpm v9 vs pnpm legacy.** The drivers are now shared (#583): `vendor_pnpm_legacy` and `revert_pnpm_legacy_opts` are thin wrappers over `pnpm_lock::vendor_pnpm_dialect` / `revert_pnpm_dialect` with `PnpmDialect::Legacy` ([`pnpm_lock_legacy.rs#L200-L223`](https://github.com/SocketDev/socket-patch/blob/045d7ec783d788bf3c5a1310724b51e09fb6505d/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs#L200-L223), [`#L894-L900`](https://github.com/SocketDev/socket-patch/blob/045d7ec783d788bf3c5a1310724b51e09fb6505d/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs#L894-L900)), and `KIND_LOCK_PACKAGE` is imported, not redefined. What stays per dialect is the legacy line grammar: `read_lock`, `preflight_package(s)`, `lock_has_target_package`, `edit_*_v54/v60`, `revert_lock_record` and the `Ctx` methods. {{E12}}
 
-**The vendor driver skeleton is copied seven times.** npm_lock, pnpm (both dialects since #583), yarn-berry, yarn-classic, bun_lock, bun_binary and vlt (about 1,940 lines) all repeat the same sequence:
-`guard_coordinates` → read the lock → preflight → `stage_patch_pack` (`stage_patch_dir` for vlt) → `already_patched_result` → `write_marker_or_warn` → a literal 20-field `VendorEntry { … pdm: None, pipenv: None, poetry: None, uv: None, … }`.
-The copies have drifted: the "patch rewrites `package.json`" warning has two codes (`vendor_dep_manifest_rewritten` vs `_stale`) and fires on in-sync re-runs for pnpm and bun only, and `bun_binary` computes its own `uuid_dir_preexisted`. `read_project`, `preflight_package(s)` and `revert_*_opts` exist in 7-9 files each. {{E22}}
+**The vendor driver skeleton is shared for six of seven drivers.** Since #1008, npm_lock, pnpm (both dialects), yarn-berry, yarn-classic, bun_lock and bun_binary implement one `npm_common::NpmLockBackend` trait driven by `vendor_npm_family`, and every npm-family ledger entry is built through `VendorEntry::npm` / `VendorArtifact::{tarball,dir}`. vlt keeps its own directory-artifact driver. The revert half is still per backend: `revert_*` lives in seven files (#920 step 6). One drift survives the merge: the "patch rewrites `package.json`" warning is still `vendor_dep_manifest_rewritten` for npm and `vendor_dep_manifest_stale` for bun. {{E22}}
 
 **Yarn berry project gates are written twice.** {{E09}}
 - cacheKey `10c0` appears as `SUPPORTED_CACHE_KEY` ([`yarn_berry_lock.rs#L89`](https://github.com/SocketDev/socket-patch/blob/045d7ec783d788bf3c5a1310724b51e09fb6505d/crates/socket-patch-core/src/vendor/yarn_berry_lock.rs#L89)) and as `YARN_BERRY_SUPPORTED_CACHE_KEY` ([`redirect/mod.rs#L3289`](https://github.com/SocketDev/socket-patch/blob/045d7ec783d788bf3c5a1310724b51e09fb6505d/crates/socket-patch-core/src/patch/redirect/mod.rs#L3287-L3289)).

doc/05-vendored.md

@@ -2,7 +2,7 @@
 
 ## Part 5: Vendored mode and the non-JS backends
 
-_Last checked against main @ cf8b164 on 2026-10-08 by audit-ecosystems (5.7 JVM layout after #1032; support-tier sizes for `bun.lockb`, pnpm legacy and vlt re-measured for E47). Earlier: `e2d9633` on 2026-10-08 by audit-ecosystems (5.3 revert mechanisms for Pipenv and Composer re-checked for E14; the E74 bullet after #1050); older checks are in the run entries. Owner: audit-ecosystems._
+_Last checked against main @ f3c6313 on 2026-10-09 by audit-ecosystems (the superseding-patch service policy across backends for E94; the E71 bullet after #1008). Earlier: `cf8b164` on 2026-10-08 by audit-ecosystems; older checks are in the run entries. Owner: audit-ecosystems._
 
 > Scope: `vendor/` framework (`mod`, `common`, `state`, `verify`, `registry_fetch`, `service_fetch`, `prestage`, `reuse`, `redownload`, `ledger_snapshots`, `parse_memo`, `path`, `source`, `toml_surgery`, `lock_inventory`); backends for cargo, gem, pypi (×10 files), golang, composer, nuget, maven and `jvm/`; related `utils/` parsers; and the CLI `vendor.rs` + `vendored_backend/`.
 
@@ -255,7 +255,8 @@ Old `kind`s are translated into `SpliceRecord`s when the ledger loads, so legacy
 ### New findings since the review
 
 - {{E74}} October 7: "is this vendored entry still in use" had four answers; it is now one discovery verdict (`Discovery::vendor_entry_in_use`), so every ecosystem's dead entries are pruned and JVM orphans are reported (#1050).
-- {{E71}} October 7: a re-pin or remove left the older patch generation's wiring behind. `patch::redirect::generation` now owns the pin-name grammar and the hosted re-pin sweep (Cargo registry block, go.sum pair, Maven `-socket.<hex8>` repository, `remove`/`rollback` by generation; #1035), and vendored uv/Hatch re-vendor was fixed by #943. The vendored and agent supersede policy is still decided per mode (#954, in PR #1008), and the Go and Maven restores still leave older generations' residue.
+- {{E71}} October 7: a re-pin or remove left the older patch generation's wiring behind. `patch::redirect::generation` now owns the pin-name grammar and the hosted re-pin sweep (Cargo registry block, go.sum pair, Maven `-socket.<hex8>` repository, `remove`/`rollback` by generation; #1035), and vendored uv/Hatch re-vendor was fixed by #943. #1008 fixed #954 for the npm family: while the superseding patch is unbuilt, the run keeps the older vendored patch and reports a skip. Every other vendored backend still fails that run (E94 below), and the Go and Maven restores still leave older generations' residue.
+- {{E94}} October 9: "keep the older vendored patch while the superseding one is unserved" (#954) is decided only for the npm family. `ServicePolicy::unserved` carries the unserved code only under the npm backends' `ServiceTerminal::Failure`; Composer, Cargo, Go, gem, PyPI, Maven and NuGet refuse `vendor_prebuilt_required`, so a re-run exits 1 with the older wiring intact until the service builds the patch (executed twice on Composer).
 - {{E80}} Maven `.jar` and NuGet `.nupkg` vendored artifacts can be git-ignored by stock templates with no warning.
 - {{E86}} Vendored JVM fetches upstream artifacts and checksums only from Central or `SOCKET_MAVEN_REGISTRY`.
 - {{E68}}: vendored gem treats a Gemfile that merely contains the copy path as wired, but its revert needs the exact recorded line and reverts the lock records anyway: a trailing comment on the wired line leaves `Gemfile.lock` restored to the registry while the Gemfile keeps `path:`, and every later revert drift-keeps (executed three times). Same forward/revert split as #977; see 5.3.

doc/06-discovery-vex.md

@@ -2,7 +2,7 @@
 
 ## Part 6: Discovery, inventory and VEX
 
-_Last checked against main @ 03b9418 on 2026-10-09 by audit-ecosystems (NuGet version identity across vendor, `PurlKey`, VEX liveness and the crawler for E93; go.mod `replace` readers, uv/pylock source handling and the Cargo crates.io source test searched). Earlier: `cf8b164` on 2026-10-08 by audit-ecosystems; older checks are in the run entries. Owner: audit-ecosystems._
+_Last checked against main @ f3c6313 on 2026-10-09 by audit-ecosystems (`vex_consumed.rs` after #1008 for E40). Earlier: `03b9418` on 2026-10-09 by audit-ecosystems; older checks are in the run entries. Owner: audit-ecosystems._
 
 > Scope: `vex/**` (incl. `vex/discover/*`), `crawlers/**`, `formats/**`, `vendor/lock_inventory/*`, and the CLI consumers `vex.rs`, `vex_sources.rs`, `vex_consumed.rs`, `scan/discovery.rs`, `context.rs`, `list.rs`, `ecosystem_dispatch.rs`.
 
@@ -94,7 +94,7 @@ Across the repo that is **eight hand-rolled XML scanners**, 4–5 independent wa
 
 - **`verify.rs` is small** (346 production lines): a hash check per record, the vendored artifact basis, and `HostedCopies`. The complexity lives elsewhere:
   - **`vex_sources.rs`** (976) merges five sources: manifest, vendor ledger, *legacy* redirect ledger, discovery refs and API-fetched records. It has 5 omission gates, 7 note codes and 3 `Basis` kinds.
-  - **`vex_consumed.rs`** (1,173 lines on `4646693`, up from 596) decides "which installed copy the hosted build consumes". That covers cargo registry host-hash matching, Maven `-socket.<hex8>` dirs, the Go replacement module, and npm alias and store variants. **This is a third copy of package-manager layout knowledge** (after the crawlers and `vendor/*`), and it lives in the CLI. Its npm alias walk now duplicates the core resolver's `alias_copies` (#738), and the Maven suffix is rebuilt beside two core builders and three parsers of the same grammar. {{E40}}
+  - **`vex_consumed.rs`** (about 450 production lines on `f3c6313`, down from 1,173 on `4646693`) decides "which installed copy the hosted build consumes". That covers cargo registry host-hash matching, Maven `-socket.<hex8>` dirs, the Go replacement module, and npm alias and store variants. **This is a third copy of package-manager layout knowledge** (after the crawlers and `vendor/*`), and it lives in the CLI. Its own npm alias walk is gone: alias copies come from the core resolver since #1008. The Maven suffix is rebuilt beside two core builders and three parsers of the same grammar. {{E40}}
   - **Discovery liveness** (`discover/mod.rs:1490-1990`, ~500 lines), including the raw-text fallbacks `vendored_wiring_in_files` and `hosted_wiring_in_files`.
 - **`product.rs`** (659 production lines) only auto-detects the top-level product purl:
   - ~200 lines parse the git `origin` remote;
@@ -163,7 +163,7 @@ cli: ProjectContext owns ONE Inventory; one EmbeddedVex helper
 
 - "Is this an sbt / Mill / scala-cli build?" had six marker lists since #690. #1032 moved them into `vendor::jvm::layout`, and `is_jvm_project` now delegates to `layout::is_jvm_build`, so an sbt root with only `project/build.properties` or a scala-cli directory with only `.scala-build` gets Coursier roots. One split remains: sbt and hosted guidance count `.mill-version` as a Mill marker (`MILL_MARKERS`), while scala-cli counts only `MILL_BUILD_FILES` (#1014). {{E69}}
 
-- npm alias discovery is written twice: core `NpmCrawler::alias_copies` (apply, rollback, the VEX installed lookup) and the CLI's `vex_consumed` walk (hosted VEX). They have drifted on case: on Linux, an alias dir whose name differs from the package only by case is a copy for VEX but invisible to apply (proven by execution). This is behind #851 and #852. {{E40}}
+- npm alias discovery was written twice, in core `NpmCrawler::alias_copies` and in the CLI's `vex_consumed`, and the two had drifted on case. Hosted VEX now resolves alias copies through the core resolver, and the CLI walk is deleted (#1008, #856). The cargo, Maven and Go consumed-copy rules are still in the CLI (#855). {{E40}}
 
 - {{E72}} October 7: VEX attested over yarn Plug'n'Play loaders, pnpm bundled copies and deno.lock npm copies. Standalone `vex` no longer does (#1033, fixing #519). The in-run `scan --mode hosted --vex` path still attests a deno project's `package-lock.json` pin (#406), and npm and vlt still emit their own bundled-copy diagnostics.
 - {{E87}} Product detection has no Gradle or sbt probe, and `scan --vex` resolves the product only after writing.

entries/audit-ecosystems/20261009T065000Z.md

@@ -0,0 +1,46 @@
+[agent] 2026-10-09: architecture audit (ecosystems and formats)
+
+**main @ `f3c6313`**. Since my last run (`03b9418`), main merged these PRs in my area:
+- #1008 (open npm issues, including #663, #922, #856 and #920 steps 1–5);
+- #1183 and #1205 (E05 NuGet and cargo children; the refactor routine recorded them);
+- #1152, #1190 and #1191.
+
+There were no maintainer replies in the discussion and no handovers for this routine.
+
+**Reconciled after #1008.** The refactor routine had not recorded these:
+- **E07** is `fixed (#1008)`: one `lock_inventory::npm::npm_lock_entries` walk serves inventory, vendored, hosted and restore. #663 is closed.
+- **E22** is `partly fixed (#1008)`. Six of the seven npm-family drivers now go through `NpmLockBackend` + `vendor_npm_family`, and ledger entries are built through `VendorEntry::npm`; #922 is closed. vlt stays separate, the revert half is still in seven files (#920 step 6), and the `vendor_dep_manifest_rewritten`/`_stale` split survives.
+- **E40** is `partly fixed (#1008)`: the CLI's npm alias walk is deleted (#856 closed). `vex_consumed.rs` is down to about 450 production lines. The cargo, Maven and Go rules remain under tracking #855.
+- **E71** is `partly fixed (#1035, #943, #1008)`. #954 is fixed for npm only, and the rest is the new E94.
+- Re-checked two open issues against main, with fresh permalinks. Both still hold:
+  - [#593](https://github.com/SocketDev/socket-patch/issues/593#issuecomment-6075912965) (E50): `rewrite_nuget` moved to `redirect/mod.rs#L5599`, and its lock walk still ignores `resolved`;
+  - [#1098](https://github.com/SocketDev/socket-patch/issues/1098#issuecomment-6075915054) (E90): unchanged. I noted that the fix must keep the default-gem homes.
+
+**Backlog.** E34 (per-PM auto-config cost) is now `rejected; deferred` under the 2026-10-08 bar. It is a cost argument with no new defect, and its dead vlt helpers stay in #782. E32 and E33 stay blocked on decisions #1200 and #1130. No decision issue was filed this run.
+
+**New finding: E94 → [#1235](https://github.com/SocketDev/socket-patch/issues/1235)** (bug).
+- #954's "keep the older vendored patch while the superseding patch is unserved" rule is decided only for the npm family. `ServicePolicy::unserved` carries `vendor_prebuilt_pending`/`_unavailable` only under `ServiceTerminal::Failure`, which only `npm_common` and `npm_dir` use. Composer, Cargo, Go, gem, PyPI, Maven and NuGet use `Refused` and map both statuses to `vendor_prebuilt_required`, which `refusal_is_benign` and `keep_older_vendored_patch` don't recognize.
+- **Proof:** a throwaway CLI test in `e2e_vendor_composer_crlf.rs`, run twice on `f3c6313`. It vendors `psr/log` at patch A, then moves the record to patch B with `pending_build` (and then `build_failed`). Both runs gave exit 1, `failed` and `vendor_prebuilt_required`, with the older wiring byte-identical. The npm test of the same scenario passes with exit 0. I reverted the test.
+- #1008 lists this as a known residual, and the contract scopes the skip to "npm family". No issue or PR covered it.
+
+**Searched without filing:** nothing else this run. The time went to reconciling #1008.
+
+**False positives ruled out:**
+- `ServicePolicy::miss` discarding `warnings`/`code` is #782 (E28), not new.
+- The `vex_consumed.rs` `#[cfg(test)]` at line 54 is a conditional import. Its test module starts at line 451.
+
+**Living document:**
+- Part 4: the package-lock row is now "1 entry walk"; the vendor-driver paragraph is rewritten for #1008.
+- Part 5: the E71 bullet is rewritten, and an {{E94}} new-findings bullet is added.
+- Part 6: the `vex_consumed.rs` size and alias text are rewritten; the E40 bullet is rewritten for #1008.
+- Check lines are refreshed in Parts 4–6.
+- Register: the statuses above, plus a new row E94. Six long status cells are shortened to bring the register back under 20,000 characters (it was 20,479).
+
+**Next backlog rows:**
+- No `to verify` row is unblocked: E32 waits on #1200, and E33 waits on #1130.
+- Next runs: re-check #1069 and #1114.
+- Hunt Maven/Gradle mirror handling in hosted vs vendored.
+- Watch #1209, #1217, #1227, #1221 and #1230 for merges.
+
+---
+_Generated by [Claude Code](https://claude.ai/code)_