@@ -1507,17 +1507,23 @@ jobs:
 
       - name: Install Maven ${{ matrix.maven || '3.9.16' }}
         if: steps.jvm.outputs.maven == 'true'
-        # Straight from the Apache archive (sha512-verified), so a leg gets
-        # exactly the release it names rather than the runner's Maven.
-        # --ssl-revoke-best-effort: see the `test` job's vexctl step.
+        # The exact release a leg names rather than the runner's Maven. The
+        # tarball comes from Maven Central's CDN (well under a second);
+        # archive.apache.org throttles bulk downloads to 1.5-5.5 minutes per
+        # leg. Its sha512 still comes from the Apache archive (Central has
+        # none for 3.6.3/3.8.9), so the bytes are checked against a digest
+        # from a second origin. --ssl-revoke-best-effort: see the `test`
+        # job's vexctl step.
         shell: bash
         env:
           MAVEN_VERSION: ${{ matrix.maven || '3.9.16' }}
         run: |
           major="${MAVEN_VERSION%%.*}"
-          url="https://archive.apache.org/dist/maven/maven-${major}/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          file="apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          url="https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/${MAVEN_VERSION}/${file}"
+          sha_url="https://archive.apache.org/dist/maven/maven-${major}/${MAVEN_VERSION}/binaries/${file}.sha512"
           curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/maven.tgz"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$sha_url" -o "$RUNNER_TEMP/maven.sha512"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha512((p/"maven.tgz").read_bytes()).hexdigest() == (p/"maven.sha512").read_text().split()[0]'
           # Python accepts native Windows paths for both archive and destination.
           python -m tarfile -e "$RUNNER_TEMP/maven.tgz" "$RUNNER_TEMP"
@@ -1983,7 +1989,12 @@ jobs:
   # ----------------------------------------------------------------------
   yarn-classic-matrix:
     name: yarn-classic ${{ matrix.release }}
-    # Only wait for preflight; this job consumes no unit-test artifacts.
+    # No `needs: [test, coverage]`: nothing here consumes their outputs,
+    # and waiting on the ~30 min windows `test` leg made this the merge
+    # queue's critical path.
+    # Dropping that `needs` also dropped the draft skip it inherited, so
+    # gate on draft here directly (push/merge_group/schedule still run).
+    # Only wait for the clippy preflight.
     if: github.event.pull_request.draft != true
     needs: clippy
     runs-on: ubuntu-latest
@@ -2021,7 +2032,12 @@ jobs:
 
   yarn-berry-e2e:
     name: yarn-berry ${{ matrix.yarn }} (${{ matrix.os }})
-    # Only wait for preflight; this job consumes no unit-test artifacts.
+    # No `needs: [test, coverage]`: nothing here consumes their outputs,
+    # and waiting on the ~30 min windows `test` leg made this the merge
+    # queue's critical path.
+    # Dropping that `needs` also dropped the draft skip it inherited, so
+    # gate on draft here directly (push/merge_group/schedule still run).
+    # Only wait for the clippy preflight.
     if: github.event.pull_request.draft != true
     needs: clippy
     strategy:
@@ -2105,7 +2121,8 @@ jobs:
   # e2e_safety_cargo_build (its headline test honours the knobs).
   cargo-vex-matrix:
     name: cargo ${{ matrix.toolchain }} lock-v${{ matrix.lock || 'own' }} (${{ matrix.os }})
-    # Only the matching OS build is needed.
+    # e2e-build only (its binaries; only the matching OS build is needed);
+    # see yarn-classic-matrix on test/coverage.
     needs: [e2e-build]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 40
@@ -2243,7 +2260,12 @@ jobs:
   # available; this leg pulls both images and requires them.
   cargo-old-toolchains:
     name: cargo old toolchains (manifest [patch])
-    # Only wait for preflight; this job consumes no unit-test artifacts.
+    # No `needs: [test, coverage]`: nothing here consumes their outputs,
+    # and waiting on the ~30 min windows `test` leg made this the merge
+    # queue's critical path.
+    # Dropping that `needs` also dropped the draft skip it inherited, so
+    # gate on draft here directly (push/merge_group/schedule still run).
+    # Only wait for the clippy preflight.
     if: github.event.pull_request.draft != true
     needs: clippy
     runs-on: ubuntu-latest
 
@@ -181,7 +181,10 @@ jobs:
         include:
           - {os: macos-latest, composer: '1.10.28', php: '8.1', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a}
           - {os: macos-latest, composer: '2.2.30', php: '8.3', sha256: 8c2b4478b64f8f7cdf1574838fdb0033b29049ca821dad452db7a3dcfcdbffc2}
-          - {os: macos-latest, composer: '2.10.3', php: '8.5', sha256: 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6}
+          # PHP 8.4 on macOS: setup-php 2.37.2 cannot install 8.5 from Homebrew
+          # since PHP 8.6 shipped (every run from 2026-10-07 23:51Z failed in
+          # "Setup PHP"). Ubuntu and Windows keep the 2.10.3 / 8.5 cell.
+          - {os: macos-latest, composer: '2.10.3', php: '8.4', sha256: 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps: *native-steps
 
@@ -256,9 +256,13 @@ jobs:
           # TLS handshake with CRYPT_E_REVOCATION_OFFLINE whenever the CA's
           # revocation server is unreachable. A revoked certificate still fails;
           # the body is checked against a digest right after. A no-op elsewhere.
-          url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          # Tarball from Maven Central's CDN, digest from the Apache archive,
+          # which throttles the tarball itself to minutes (ci.yml's copy).
+          file="apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          url="https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/${MAVEN_VERSION}/${file}"
+          sha_url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/${file}.sha512"
           curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/maven.tgz"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$sha_url" -o "$RUNNER_TEMP/maven.sha512"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha512((p/"maven.tgz").read_bytes()).hexdigest() == (p/"maven.sha512").read_text().split()[0]'
           python -m tarfile -e "$RUNNER_TEMP/maven.tgz" "$RUNNER_TEMP"
           launcher="$RUNNER_TEMP/apache-maven-${MAVEN_VERSION}/bin/mvn"
 
@@ -687,7 +687,6 @@ pub const GLOBAL_ARG_ENV_VARS: &[&str] = &[
 /// missing here escapes the empty-var scrub — the invariant tests below
 /// parse every entry against its owning subcommand to keep this honest.
 pub const LOCAL_ARG_ENV_VARS: &[&str] = &[
-    "SOCKET_FORCE",
     "SOCKET_PATCH_VERSION",
     "SOCKET_SAVE_ONLY",
     "SOCKET_ALL_RELEASES",
@@ -775,6 +774,13 @@ impl Default for GlobalArgs {
     }
 }
 
+/// True for a golang PURL in local mode (no `--global` / `--global-prefix`):
+/// `apply` redirects it to a project-local patched copy via a `go.mod`
+/// `replace`, and `rollback` drops the same redirect.
+pub(crate) fn is_local_go(purl: &str, common: &GlobalArgs) -> bool {
+    !common.is_global() && Ecosystem::from_purl(purl) == Some(Ecosystem::Golang)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1634,9 +1640,6 @@ mod tests {
         // (env var, argv of a subcommand that binds it) — every bool entry
         // of `LOCAL_ARG_ENV_VARS`, on each subcommand that binds it.
         const BOOL_BINDINGS: &[(&str, &[&str])] = &[
-            ("SOCKET_FORCE", &["socket-patch", "apply"]),
-            ("SOCKET_FORCE", &["socket-patch", "vendor"]),
-            ("SOCKET_FORCE", &["socket-patch", "self-update"]),
             ("SOCKET_SAVE_ONLY", &["socket-patch", "get", "x"]),
             ("SOCKET_ALL_RELEASES", &["socket-patch", "get", "x"]),
             ("SOCKET_ALL_RELEASES", &["socket-patch", "scan"]),
@@ -1674,6 +1677,48 @@ mod tests {
         });
     }
 
+    /// v5 retired `SOCKET_FORCE` (#615): `--force` is flag-only on `apply`,
+    /// `vendor` and `--update`. A stale export must be ignored, so it can
+    /// never quietly skip the beforeHash check or the managed-install
+    /// refusal; the flag itself still works.
+    #[test]
+    #[serial_test::serial]
+    fn socket_force_env_is_ignored_and_force_flag_still_works() {
+        fn force_of(argv: &[&str]) -> bool {
+            let argv = argv.iter().map(|s| s.to_string()).collect();
+            match crate::parse_argv_with_shortcuts(argv)
+                .unwrap_or_else(|e| panic!("parse failed: {e}"))
+                .command
+            {
+                crate::Commands::Apply(a) => a.force,
+                crate::Commands::Vendor(a) => a.force,
+                crate::Commands::SelfUpdate(a) => a.force,
+                _ => panic!("unexpected subcommand"),
+            }
+        }
+
+        const ARGVS: &[&[&str]] = &[
+            &["socket-patch", "apply"],
+            &["socket-patch", "vendor"],
+            &["socket-patch", "self-update"],
+            &["socket-patch", "--update"],
+        ];
+
+        with_clean_socket_env(|| {
+            with_env_cleared(&["SOCKET_FORCE"], || {
+                for val in ["1", "true", "yes"] {
+                    std::env::set_var("SOCKET_FORCE", val);
+                    for &argv in ARGVS {
+                        assert!(!force_of(argv), "SOCKET_FORCE={val} set force on {argv:?}");
+                        let mut with_flag = argv.to_vec();
+                        with_flag.push("--force");
+                        assert!(force_of(&with_flag), "--force ignored on {argv:?}");
+                    }
+                }
+            });
+        });
+    }
+
     /// Companion invariant for the **value-typed** local env vars: an
     /// exported-but-empty value (`VAR=`) must not crash its subcommand —
     /// [`scrub_empty_env_vars`] (run by `main` before clap) removes it, and