diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 6f659dda6..7a382e9ca 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -372,7 +372,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
-| maven | `pom.xml` (+ `.mvn/maven.config`, `.mvn/checksums/checksums.sha256`) | a dependency version `<base>-socket.<hex8>` matching exactly ONE `socket-patch-<uuid>` repository on the patch host | `socket-patch-vendor-<uuid>` repository + exactly one jar under `.socket/vendor/maven/<uuid>/` with a matching `.sha1` | Trusted Checksums line when enabled; not required (the suffixed version is the pin) |
+| maven | `pom.xml` (+ `.mvn/maven.config`, `.mvn/checksums/checksums.sha256`) | a dependency version `<base>-socket.<hex8>` matching exactly ONE `socket-patch-<uuid>` repository on the patch host | pre-v5 single-POM wiring only: `socket-patch-vendor-<uuid>` repository + exactly one jar under `.socket/vendor/maven/<uuid>/` with a matching `.sha1`. A v5 suffixed pin served from `.socket/vendor/maven2` is no reference here: its ledger entry's wiring check gates it, so without a ledger it is not attested | Trusted Checksums line when enabled; not required (the suffixed version is the pin) |
 | gradle (v5.0) | `.socket/gradle/hosted-index.tsv`, the owned hosted script, and every settings script and lock file the script graph reaches | an index row whose repository URL is on the patch host and names the row's uuid, live only while the owned script is intact, every build's settings file applies it with the current index digest, every lock entry of the GA is the suffixed version, no `settings-gradle.lockfile` names the GA and no build script sets a custom `lockFile` (otherwise `patched_ref_invalid`) | none here: a vendored Gradle entry is gated by its ledger entry's wiring check | the suffixed copies installed in the Gradle cache; required (never the lock basis), because the script lets a higher upstream version resolve |
 | nuget | the first of `nuget.config` / `NuGet.config` / `NuGet.Config`, + `packages.lock.json` | source `socket-patch-<uuid>` + its exclusive exact-id `<packageSourceMapping>`; version from `packages.lock.json` | the same mapping onto `.socket/vendor/nuget/<uuid>`; version from the lock, else the feed's single nupkg | `contentHash`, required |
 | deno | `deno.lock`'s npm section, only as evidence against an npm-family pin of a `name@version` it also locks, which `vex` then omits (see **Unattested references**, #406) | — (no hosted mode) | — (no vendored backend) | — |
@@ -738,7 +738,7 @@ to **six flavors**.
 | pypi / pipenv (Pipfile.lock) | (rebuilt wheel) | lock-only: the `default`/`develop` entry → `{file, hashes:[sha256-of-our-wheel]}`. Pipfile + `_meta.hash` untouched. Emits `vendor_integrity_unverified` — pipenv does not hash-check file entries; the committed wheel bytes are the protection | `pipenv install --deploy` (+ `pipenv verify`), cold cache |
 | pypi / requirements.txt (pip / `uv pip`) | (rebuilt wheel) | pin line → `./<wheel>` (markers carried over; transitive deps appended), plus `--hash=sha256:<hex>` only when the requirements tree is already in pip's hash-checking mode (any `--hash` or `--require-hashes`) | `pip install -r` / `uv pip install -r` **run from the project root** (both resolve bare paths against the CWD) |
 | nuget | deterministically rebuilt `.nupkg` at `<idLower>.<versionNorm>.nupkg` (the uuid dir IS a NuGet folder feed; the stale embedded signature is dropped — unsigned is accepted under NuGet's default validation) | `nuget.config` source + `packageSourceMapping` for the id (creating the mapping from scratch ALSO fans a `<package pattern="*" />` out to every pre-existing source — mapping is exclusive, NU1100 otherwise) **+** `packages.lock.json` `contentHash` → `base64(sha512(nupkg))` when the lock exists (`vendor_nuget_no_lockfile` warning otherwise) | `dotnet restore --locked-mode`, cold cache, `--network none` (tampered nupkg fails NU1403) |
-| maven | deterministically rebuilt `.jar` + the **verbatim upstream pom** (transitives survive; refused via `vendor_maven_pom_unavailable` rather than fabricated) + `.sha1` sidecars, laid out as a maven2 repository under the uuid dir | `pom.xml` `<repository>` (`id=socket-patch-vendor-<uuid>`, `url=file://${project.basedir}/.socket/vendor/maven/<uuid>`, `checksumPolicy=fail`, snapshots disabled). Multi-module aggregator poms refused (`vendor_maven_multimodule_unsupported`); gradle-only projects refused (`vendor_gradle_unsupported`); always-on `vendor_maven_local_cache_shadow` advisory (warm `~/.m2` wins over any repository) | `mvn` build on a fresh checkout with the GAV purged from the local repo, `--network none` (docker capstone; note `mvn -o` refuses `file://` repositories outright) |
+| maven | the patched `.jar` + the upstream pom (only its `<version>` suffixed; transitives survive) + `.sha1` sidecars + an ownership marker under `.socket/vendor/maven2/<g-path>/<a>/<v>-socket.<hex8>/` | every pom root, single-module (a reactor of one) or multi-module: the pinned `<version>` + `<dependencyManagement>` pin, `.mvn/maven.config` (`maven.repo.local.tail`) and the `socket-patch-vendor` fallback file repository (`checksumPolicy=fail`); Gradle, sbt and scala-cli roots go to the same JVM backend (ledger ecosystem `jvm`). Pre-v5 `maven_pom_repository` entries (`<repository>` to `.socket/vendor/maven/<uuid>`) are revert-only: vendoring their root is refused (`vendor_jvm_shape_unsupported`, `legacy_maven_root`) | `mvn` build on a fresh checkout with a warm local repository and behind `mirrorOf external:*` (host capstone `e2e_vendor_maven_build` across the Maven matrix) |
 
 Ecosystems with no vendor backend (jsr) refuse per-purl with
 `vendor_unsupported_ecosystem`. yarn-berry **PnP**
@@ -1760,7 +1760,8 @@ If you add a new flag/subcommand/JSON key, add a test here that locks the new su
 
 ### Vendored JVM support (v5)
 
-Maven reactors and Gradle 6.8+ route to the JVM backend automatically. Ledger
+Every Maven root (a single-module `pom.xml` is a reactor of one) and Gradle 6.8+
+route to the JVM backend automatically. Ledger
 entries use ecosystem `jvm` with Maven PURLs. Revert, remove, rollback and repair
 share the v5 vendored backend; existing prototype wiring remains readable.
 See [the JVM design](../../docs/design/maven-vendoring.md) for supported shapes.
@@ -1852,8 +1853,8 @@ tree root's `jvm_owned_file`s, and the usual tree/upstream records. Revert drops
 the patch's rows in any order and deletes the generated file, after a strict
 parse proves it socket-patch's, once no pins remain; an edited file is
 `vendor_lock_entry_drifted` and keeps the tree while it still names the patch.
-A project already vendored through the Maven reactor, the single-pom path or the
-Gradle backend stays on it when sbt files appear. A generated file left without
+A project already vendored through the Maven reactor (single-module or not), the
+pre-v5 single-pom path or the Gradle backend stays on it when sbt files appear. A generated file left without
 a ledger is `vendor_ledger_missing` for `vendor --check`. Refusals (nothing written):
 `vendor_sbt_build_root_unknown` (no `sbt.version`; a subproject directory
 inside an sbt build is `vendor_jvm_shape_unsupported` with
@@ -2133,12 +2134,20 @@ with `reason: <reason>: `:
 
 | Code | Effect | Gradle reasons |
 |---|---|---|
-| `vendor_jvm_shape_unsupported` | refusal, nothing written | `gradle_below_6_8`, `android_or_kmp` (also `available-at` module redirects), `gradle_exclusive_content_conflict` (a user rule claiming the module, in any script), `gradle_range_excludes_vendored` (no declared selector admits the vendored version), `gradle_verification_unparseable`, `gradle_index_unreadable`, `build_file_unreadable` (including a non-UTF-8 settings file), `build_file_outside_root`, `not_build_root` (run from a directory an ancestor settings file includes or may include, from a project with no settings file of its own below one, or below an ancestor settings file that is not UTF-8; `repair` refuses there too), `no_build_file` |
+| `vendor_jvm_shape_unsupported` | refusal, nothing written | `gradle_below_6_8`, `android_or_kmp` (also `available-at` module redirects), `gradle_exclusive_content_conflict` (a user rule claiming the module, in any script), `gradle_range_excludes_vendored` (no declared selector admits the vendored version), `gradle_verification_unparseable`, `gradle_index_unreadable`, `build_file_unreadable` (including a non-UTF-8 settings file), `build_file_outside_root`, `not_build_root` (run from a directory an ancestor settings file includes or may include, from a project with no settings file of its own below one, or below an ancestor settings file that is not UTF-8; `repair` refuses there too), `no_build_file` (no `pom.xml`, Gradle, sbt or scala-cli build at the root), `legacy_maven_root` (the root's ledger still holds a pre-v5 single-POM `maven_pom_repository` entry; the whole root is refused until `vendor --revert`, then vendor again) |
 | `vendor_jvm_upstream_unavailable` | refusal | `classifier_unavailable` (a declared classifier jar no cache or registry has), `module_unavailable` (the pom declares Gradle module metadata that cannot be sourced), `pom_unavailable`, `verification_metadata_unavailable` |
-| `vendor_jvm_degraded` | applied, VEX withheld | `gradle_unscanned_build_logic`, `unwired_build_logic` (a nonliteral included build), `settings_plugins_unwired`, `classifier_unpatched_copy` (a classifier jar carries an unpatched copy of a patched member), `verification_parent_chain_unhandled`, `legacy_maven_root` (a single-POM root next to a Gradle build whose ledger already holds a single-POM entry; the Gradle build stays unpatched until `vendor --revert` and vendor again) |
+| `vendor_jvm_degraded` | applied, VEX withheld | `gradle_unscanned_build_logic`, `unwired_build_logic` (a nonliteral included build), `settings_plugins_unwired`, `classifier_unpatched_copy` (a classifier jar carries an unpatched copy of a patched member), `verification_parent_chain_unhandled` |
 | `vendor_jvm_note` | applied, informational | `range_declared` (a range, prefix or rich selector lists versions from the derived `maven-metadata.xml`), `ide_sources_unavailable` |
 | `vendor_jvm_upstream_unverified` | warning | Upstream metadata was taken offline and not authenticated against registry checksums. |
-| `vendor_gradle_unsupported` | refusal | Legacy single-POM path only: a Gradle project with no `pom.xml` that the JVM backend did not route. |
+
+The Maven half of a root (single-module, reactor or mixed) also reports
+`vendor_jvm_degraded` with `reason: maven_f_outside_root` (Maven 3.9.2–3.9.8
+cannot read the repository tail with `-f` from outside the root) and
+`reason: maven_mirror_of_all` (Maven before 3.9.2, or `--maven-config=none`,
+reads the fallback file repository, which a `mirrorOf=*` mirror captures)
+whenever `.mvn/wrapper/maven-wrapper.properties` does not prove a Maven outside
+those ranges — so every wrapper-less project gets both. The patch is applied
+and these two do not withhold VEX.
 
 A root holding both `pom.xml` and a Gradle build vendors both in one ledger entry
 (#395); either half refusing writes nothing. A derived
diff --git a/crates/socket-patch-cli/tests/docker_e2e_vendor_maven.rs b/crates/socket-patch-cli/tests/docker_e2e_vendor_maven.rs
index 94918217d..a8939e3c4 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_vendor_maven.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_vendor_maven.rs
@@ -1,12 +1,13 @@
 //! Docker build-proof capstone for `socket-patch vendor` — maven flavor.
 //!
-//! Proves the vendor "maven2 file:// repository" row end to end against a REAL
-//! Apache Maven + JDK inside `socket-patch-test-maven:latest`, with state
+//! Proves the vendored Maven row end to end for a single-module project
+//! (planned as a reactor of one, #973) against a REAL Apache Maven + JDK
+//! inside `socket-patch-test-maven:latest` (Debian's Maven), with state
 //! carried across containers via a bind-mounted host tempdir (see
 //! `docker_vendor_common/`). The target is `commons-text:1.10.0`, chosen
 //! because it declares exactly one TRANSITIVE dependency (`commons-lang3`) —
-//! the leg that proves the vendored pom is the REAL upstream pom (a fabricated
-//! minimal pom would silently drop the transitive).
+//! the leg that proves the vendored pom is the REAL upstream pom (only its
+//! version suffixed).
 //!
 //!   stage 1 (networked): a project depending on commons-text →
 //!     `mvn dependency:copy-dependencies` warms the local Maven repo
@@ -14,41 +15,28 @@
 //!     machinery → a marker patch on the extracted-jar's `META-INF/NOTICE.txt`
 //!     is hand-staged (manifest + blob; git-blob sha256 from the ACTUAL cached
 //!     bytes) → `socket-patch vendor --json` (baked binary) →
-//!     asserts: the rebuilt `.jar` under the
-//!     maven2 leaf `.socket/vendor/maven/<uuid>/…`, the verbatim upstream pom
-//!     beside it (carrying the commons-lang3 transitive), the `.sha1` sidecars,
-//!     `socket-patch.vendor.json`, `state.json`, the `<repository>` inserted
-//!     into `pom.xml` (id + file:// url + checksumPolicy=fail), and the
-//!     ALWAYS-ON `vendor_maven_local_cache_shadow` advisory; then
-//!     `socket-patch vex` attests the vendored patch. Finally commons-text is
-//!     PURGED from `$M2` and only the committable files (pom.xml + .socket/)
-//!     are staged for stage 2.
-//!   stage 2 (`--network none`): strictest consumption proof. Maven checks the
-//!     LOCAL repo before any `<repository>`, so `$M2` keeps the plugins + the
-//!     commons-lang3 transitive but has commons-text PURGED — the vendored
-//!     file:// repo is therefore the ONLY source of the patched commons-text.
-//!     NOTE: `mvn -o` (offline mode) REFUSES file:// repositories outright
-//!     ("Cannot access … in offline mode"); the vendored feed is exercised by
-//!     CUTTING THE NETWORK at the container level (`--network none`) WITHOUT
-//!     `-o`, so file:// stays usable while Maven Central is unreachable — the
-//!     maven analog of the nuget capstone's `--network none` + local folder
-//!     feed. A RED probe (feed removed → resolve fails) proves the feed is
-//!     load-bearing; a TAMPER probe (mutated jar + stale sidecar → cold
-//!     re-resolve) proves `checksumPolicy=fail` rejects it.
-//!
-//!     What offline CAN prove here: (a) the patched commons-text.jar is served
-//!     from the file:// vendored repo (byte-identical to the committed jar, and
-//!     it was PURGED from `$M2` so it can only have come from file://); (b) the
-//!     vendored pom carries the REAL transitive declaration (commons-lang3
-//!     lands in the copy-dependencies output). What offline CANNOT prove: that
-//!     the transitive was freshly fetched — it is resolved from the warm `$M2`
-//!     cache. That is the point: the pom must DECLARE it, which a minimal pom
-//!     would not.
-//!   stage 3 (service available): re-warm commons-text into `$M2` from the
-//!     project's own clean file:// repo (stage 2 left `$M2` cold for it) →
-//!     idempotent re-vendor (`already_vendored`, pom.xml + jar byte-stable) →
-//!     `vendor --revert` restores `pom.xml` byte-identical and removes
-//!     `.socket/vendor` → a re-vendor succeeds again.
+//!     asserts: the patched jar, the suffixed upstream pom (carrying the
+//!     commons-lang3 transitive), the `.sha1` sidecars and the ownership
+//!     marker under `.socket/vendor/maven2/<g>/<a>/1.10.0-socket.<hex8>/`,
+//!     `state.json`, the pinned `<version>` and `socket-patch-vendor`
+//!     repository in `pom.xml`, `.mvn/maven.config`, and the wrapper-less
+//!     `vendor_jvm_degraded` warnings; then `socket-patch vex` attests the
+//!     vendored patch. The committable files (pom.xml + .mvn/ + .socket/)
+//!     are staged for stage 2. `$M2` stays WARM: the cached 1.10.0 cannot
+//!     shadow the suffixed pin.
+//!   stage 2 (`--network none`): consumption proof without Central. Only the
+//!     suffixed version is purged from `$M2` before each resolve (older Maven
+//!     copies it there from the fallback file repository); the cached
+//!     upstream 1.10.0 stays. A RED probe (tree removed → resolve fails)
+//!     proves the tree is load-bearing; the GREEN resolve copies the
+//!     committed jar byte for byte; a TAMPER probe (mutated jar + stale
+//!     sidecar) must fail on the checksum where Maven reads the fallback
+//!     `checksumPolicy=fail` repository (before 3.9.2), and is logged on
+//!     Maven 3.9.2+ (the repository tail is a local repository).
+//!   stage 3 (service available): idempotent re-vendor (`already_vendored`,
+//!     every file byte-stable) → `vendor --revert` restores `pom.xml` byte
+//!     for byte and removes `.mvn` and `.socket/vendor` → a re-vendor succeeds
+//!     again.
 
 #![cfg(feature = "docker-e2e")]
 
@@ -63,9 +51,11 @@ use docker_vendor_common::{
 };
 
 const IMAGE: &str = "socket-patch-test-maven:latest";
-/// Canonical lowercase patch uuid — a dedicated path level under
-/// `.socket/vendor/maven/` and the suffix of the injected `<repository>` id.
+/// Canonical lowercase patch uuid; its first 8 hex digits suffix the
+/// vendored version.
 const UUID: &str = "16161616-1616-4161-8161-161616161616";
+/// The suffixed version the planner pins.
+const SV: &str = "1.10.0-socket.16161616";
 /// The staged patch's vulnerability id — the stage-1 VEX leg must attest
 /// exactly this (mirrors GHSA-vend-nuget-real in the nuget capstone).
 const GHSA: &str = "GHSA-vend-maven-real";
@@ -83,6 +73,7 @@ fn render(stage_body: &str) -> String {
         stage_body
     )
     .replace("__UUID__", UUID)
+    .replace("__SV__", SV)
     .replace("__GHSA__", GHSA)
 }
 
@@ -157,25 +148,28 @@ assert_json_field /tmp/vendor.json '"action": "applied"'
 assert_json_field /tmp/vendor.json "$PURL_ENV"
 assert_summary /tmp/vendor.json applied 1
 assert_summary /tmp/vendor.json failed 0
-# The always-on local-cache shadow advisory must be surfaced (commons-text is
-# warm in $M2 at vendor time, so it WOULD shadow the vendored copy).
-assert_json_field /tmp/vendor.json 'vendor_maven_local_cache_shadow'
+# No Maven Wrapper: both wrapper-less warnings; never the retired shadow one.
+assert_json_field /tmp/vendor.json 'reason: maven_f_outside_root: '
+assert_json_field /tmp/vendor.json 'reason: maven_mirror_of_all: '
+grep -q 'vendor_maven_local_cache_shadow' /tmp/vendor.json && fail "retired shadow warning emitted"
 echo "===VENDOR RUN VERIFIED==="
 
-# 4. Artifact: rebuilt jar + verbatim upstream pom + sha1 sidecars at the
-#    maven2 leaf; informational marker + committed ledger.
-LEAF=".socket/vendor/maven/__UUID__/org/apache/commons/commons-text/1.10.0"
-VJAR="$LEAF/commons-text-1.10.0.jar"
-VPOM="$LEAF/commons-text-1.10.0.pom"
+# 4. Artifact: patched jar + suffixed upstream pom + sha1 sidecars + the
+#    ownership marker in the suffixed tree; committed ledger.
+LEAF=".socket/vendor/maven2/org/apache/commons/commons-text/__SV__"
+VJAR="$LEAF/commons-text-__SV__.jar"
+VPOM="$LEAF/commons-text-__SV__.pom"
 [ -f "$VJAR" ]      || { ls -R .socket/vendor >&2 || true; fail "vendored jar missing at $VJAR"; }
 [ -f "$VPOM" ]      || fail "vendored upstream pom missing at $VPOM"
 [ -f "$VJAR.sha1" ] || fail "vendored jar sha1 sidecar missing"
 [ -f "$VPOM.sha1" ] || fail "vendored pom sha1 sidecar missing"
-[ -f ".socket/vendor/maven/__UUID__/socket-patch.vendor.json" ] || fail "informational marker missing"
+[ -f "$LEAF/socket-patch.vendor.json" ] || fail "ownership marker missing"
 [ -f ".socket/vendor/state.json" ] || fail "vendor ledger (state.json) missing"
-# The vendored pom is the REAL upstream one (carries the transitive) — NOT a
-# fabricated minimal stand-in.
+[ ! -e ".socket/vendor/maven" ] || fail "the retired .socket/vendor/maven tree was written"
+# The vendored pom is the REAL upstream one (carries the transitive), with
+# only its version suffixed.
 grep -q 'commons-lang3' "$VPOM" || { cat "$VPOM" >&2; fail "vendored pom dropped the commons-lang3 transitive"; }
+grep -q '<version>__SV__</version>' "$VPOM" || { cat "$VPOM" >&2; fail "vendored pom is not suffixed"; }
 # The patched marker really is inside the rebuilt jar.
 rm -rf /tmp/vjx && mkdir -p /tmp/vjx && ( cd /tmp/vjx && jar xf "$OLDPWD/$VJAR" META-INF/NOTICE.txt 2>/dev/null || jar xf "$OLDPWD/$VJAR" )
 grep -q 'SOCKET-PATCH-VENDOR-E2E-MARKER' /tmp/vjx/META-INF/NOTICE.txt || fail "rebuilt jar's NOTICE.txt is not patched"
@@ -185,10 +179,11 @@ grep -q 'SOCKET-PATCH-VENDOR-E2E-MARKER' /tmp/vjx/META-INF/NOTICE.txt || fail "r
 [ "$(sha1sum "$VJAR" | cut -d' ' -f1)" = "$(cat "$VJAR.sha1" | tr -d '[:space:]')" ] || fail "jar .sha1 sidecar does not match the jar bytes"
 echo "===ARTIFACT VERIFIED==="
 
-# 5. pom.xml wiring: our <repository> (id + file:// url + checksumPolicy=fail).
-grep -q "<id>socket-patch-vendor-__UUID__</id>" pom.xml || { cat pom.xml >&2; fail "pom.xml missing our <repository> id"; }
-grep -q 'file://${project.basedir}/.socket/vendor/maven/__UUID__' pom.xml || { cat pom.xml >&2; fail "pom.xml missing the file:// vendored repo url"; }
+# 5. Wiring: the pinned version, the fallback repository and maven.config.
+grep -q '<version>__SV__</version>' pom.xml || { cat pom.xml >&2; fail "pom.xml missing the suffixed pin"; }
+grep -q '<id>socket-patch-vendor</id>' pom.xml || { cat pom.xml >&2; fail "pom.xml missing the fallback repository"; }
 grep -q '<checksumPolicy>fail</checksumPolicy>' pom.xml || { cat pom.xml >&2; fail "pom.xml repository missing checksumPolicy=fail"; }
+grep -q 'maven.repo.local.tail=' .mvn/maven.config || { cat .mvn/maven.config >&2 || true; fail ".mvn/maven.config missing the repository tail"; }
 echo "===POM WIRING VERIFIED==="
 
 # 6. Real-toolchain VEX: attest the vendored patch (maven has no product
@@ -200,13 +195,11 @@ RC=$?; cat /tmp/vex.err >&2
 [ -s out.vex.json ] || fail "vex did not write out.vex.json"
 echo "===VEX RUN VERIFIED==="
 
-# 7. Purge commons-text from $M2 (keep commons-lang3 + the plugins) so stage 2's
-#    consumption can ONLY come from the file:// vendored repo.
-rm -rf "$CACHED"
-
-# 8. Fresh-checkout staging: ONLY the committable files.
+# 7. Fresh-checkout staging: ONLY the committable files. $M2 stays warm
+#    (the cached upstream 1.10.0 cannot shadow the suffixed pin).
 rm -rf /workspace/fresh && mkdir -p /workspace/fresh
 cp pom.xml /workspace/fresh/
+cp -R .mvn /workspace/fresh/.mvn
 cp -R .socket /workspace/fresh/.socket
 echo "===STAGE1 VERIFIED==="
 exit 0
@@ -223,62 +216,61 @@ cd /workspace/fresh
 # The committable set must not have leaked a build/output tree.
 [ ! -e target ] || fail "fresh checkout already has target/ (test bug: uncommittable file copied)"
 
-LEAF=".socket/vendor/maven/__UUID__/org/apache/commons/commons-text/1.10.0"
-VJAR="$LEAF/commons-text-1.10.0.jar"
+LEAF=".socket/vendor/maven2/org/apache/commons/commons-text/__SV__"
+VJAR="$LEAF/commons-text-__SV__.jar"
+SUFFIXED="$M2/org/apache/commons/commons-text/__SV__"
+[ -f "$M2/org/apache/commons/commons-text/1.10.0/commons-text-1.10.0.jar" ] \
+  || fail "the local repository must stay warm with the upstream 1.10.0"
 
-# RED PROBE: with the vendored feed removed AND commons-text absent from $M2,
-# the resolve MUST fail (network is cut, so Central is unreachable too).
-# NOTE: Maven RECREATES the file:// repo's base dir (`.socket/vendor/...`)
-# while probing it during the failed resolve, so the vendored repo is backed
-# up with `cp` and restored with `rm -rf` + `cp` — a naive `mv` back would land
-# INSIDE the dir Maven recreated and misplace the artifact.
+# RED PROBE: with the vendored tree removed (and the suffixed version purged
+# from $M2), the resolve MUST fail: the network is cut and no other
+# repository has the suffixed version.
 cp -r .socket/vendor /tmp/vendor-backup
-rm -rf .socket/vendor
-rm -rf "$M2/org/apache/commons/commons-text"
-rm -rf target
+rm -rf .socket/vendor "$SUFFIXED" target
 $MVN dependency:copy-dependencies -DoutputDirectory=target/red > /tmp/red.log 2>&1
 RED_RC=$?
 [ "$RED_RC" -ne 0 ] || { cat /tmp/red.log >&2; fail "RED PROBE VACUOUS: resolve SUCCEEDED with .socket/vendor removed"; }
-grep -qiE 'could not resolve|cannot access|transfer failed|non-resolvable|failure to find' /tmp/red.log \
+grep -qiE 'could not resolve|cannot access|transfer failed|non-resolvable|failure to find|could not find' /tmp/red.log \
   || { cat /tmp/red.log >&2; fail "RED PROBE: resolve failed for an unexpected reason"; }
 rm -rf .socket/vendor
 cp -r /tmp/vendor-backup .socket/vendor
 echo "===RED PROBE VERIFIED==="
 
-# GREEN: network cut, commons-text purged from $M2 → the ONLY source of the
-# patched commons-text is the file:// vendored repo. commons-lang3 (transitive)
-# resolves from the warm $M2 cache.
-rm -rf "$M2/org/apache/commons/commons-text"
-rm -rf target
+# GREEN: network cut, the WARM upstream 1.10.0 still cached: the patched
+# suffixed jar can only come from the committed tree.
+rm -rf "$SUFFIXED" target
 $MVN dependency:copy-dependencies -DoutputDirectory=target/dep > /tmp/green.log 2>&1 \
-  || { cat /tmp/green.log >&2; fail "cold-target offline resolve against the file:// repo failed"; }
-[ -f target/dep/commons-text-1.10.0.jar ]  || { ls target/dep >&2 || true; fail "patched commons-text jar not copied from the vendored repo"; }
+  || { cat /tmp/green.log >&2; fail "offline resolve against the vendored tree failed"; }
+[ -f target/dep/commons-text-__SV__.jar ] || { ls target/dep >&2 || true; fail "patched commons-text jar not copied from the vendored tree"; }
+[ ! -e target/dep/commons-text-1.10.0.jar ] || fail "the cached upstream 1.10.0 shadowed the pin"
 [ -f target/dep/commons-lang3-3.12.0.jar ] || { ls target/dep >&2 || true; fail "commons-lang3 transitive missing — the vendored pom did not declare it"; }
-
-# The copied jar is BYTE-IDENTICAL to our committed vendored jar (it came from
-# the file:// repo, not Central).
-cmp -s target/dep/commons-text-1.10.0.jar "$VJAR" \
+cmp -s target/dep/commons-text-__SV__.jar "$VJAR" \
   || fail "resolved commons-text jar is not byte-identical to the vendored jar"
-# And it really carries the patched marker.
-rm -rf /tmp/cjx && mkdir -p /tmp/cjx && ( cd /tmp/cjx && jar xf "/workspace/fresh/target/dep/commons-text-1.10.0.jar" META-INF/NOTICE.txt 2>/dev/null || jar xf "/workspace/fresh/target/dep/commons-text-1.10.0.jar" )
+rm -rf /tmp/cjx && mkdir -p /tmp/cjx && ( cd /tmp/cjx && jar xf "/workspace/fresh/target/dep/commons-text-__SV__.jar" META-INF/NOTICE.txt 2>/dev/null || jar xf "/workspace/fresh/target/dep/commons-text-__SV__.jar" )
 grep -q 'SOCKET-PATCH-VENDOR-E2E-MARKER' /tmp/cjx/META-INF/NOTICE.txt || fail "consumed commons-text jar is not patched"
 [ "$(sha256sum /tmp/cjx/META-INF/NOTICE.txt | cut -d' ' -f1)" = "$(cat /workspace/snap/patched.sha)" ] \
   || fail "consumed NOTICE.txt is not byte-identical to the staged patched bytes"
 echo "===FRESH INSTALL VERIFIED==="
 
-# TAMPER PROBE: mutate the vendored jar (leaving its .sha1 stale), purge the
-# target from $M2, and force a cold re-resolve → checksumPolicy=fail must reject
-# it. Restore the pristine jar afterward (stage 3 re-warms $M2 from the clean
-# vendored repo).
+# TAMPER PROBE: mutate the vendored jar (leaving its .sha1 stale) and force a
+# cold re-resolve. Before Maven 3.9.2 the fallback file repository
+# (checksumPolicy=fail) serves it, so the resolve must fail on the checksum.
+# 3.9.2+ reads the repository tail, a local repository Maven does not
+# checksum; that outcome is logged (VEX never attests a tampered tree).
+MVN_VERSION=$(mvn -v 2>/dev/null | head -1 | sed -E 's/^Apache Maven ([0-9.]+).*/\1/')
 cp "$VJAR" /tmp/vjar.pristine
 printf 'TAMPER' >> "$VJAR"
-rm -rf "$M2/org/apache/commons/commons-text"
-rm -rf target
+rm -rf "$SUFFIXED" target
 $MVN dependency:copy-dependencies -DoutputDirectory=target/tamper > /tmp/tamper.log 2>&1
 TAMPER_RC=$?
-[ "$TAMPER_RC" -ne 0 ] || { cat /tmp/tamper.log >&2; fail "TAMPER PROBE VACUOUS: resolve SUCCEEDED on a mutated jar"; }
-grep -qi 'checksum' /tmp/tamper.log || { cat /tmp/tamper.log >&2; fail "TAMPER PROBE: expected a checksum validation failure"; }
+if [ "$(printf '%s\n3.9.2\n' "$MVN_VERSION" | sort -V | head -1)" != "3.9.2" ]; then
+  [ "$TAMPER_RC" -ne 0 ] || { cat /tmp/tamper.log >&2; fail "TAMPER PROBE VACUOUS: Maven $MVN_VERSION resolved a mutated jar"; }
+  grep -qi 'checksum' /tmp/tamper.log || { cat /tmp/tamper.log >&2; fail "TAMPER PROBE: expected a checksum validation failure"; }
+else
+  echo "TAMPER (Maven $MVN_VERSION, repository tail): exit $TAMPER_RC" >&2
+fi
 cp /tmp/vjar.pristine "$VJAR"
+rm -rf "$SUFFIXED" target
 echo "===TAMPER CHECKSUM VERIFIED==="
 exit 0
 "#;
@@ -292,16 +284,10 @@ export MAVEN_REPO_LOCAL="$M2"
 export SOCKET_TELEMETRY_DISABLED=1
 MVN="mvn -q -Dmaven.repo.local=$M2 -Dmaven.test.skip=true -Dstyle.color=never"
 cd /workspace/proj
-LEAF=".socket/vendor/maven/__UUID__/org/apache/commons/commons-text/1.10.0"
-VJAR="$LEAF/commons-text-1.10.0.jar"
-
-# Stage 2 left commons-text cold in $M2. Re-warm it from THIS project's own
-# clean (untampered) file:// vendored repo (network cut, no -o) so the crawler
-# can find the installed package again.
-rm -rf "$M2/org/apache/commons/commons-text"
-$MVN dependency:copy-dependencies -DoutputDirectory=/tmp/rewarm > /tmp/rewarm.log 2>&1 \
-  || { cat /tmp/rewarm.log >&2; fail "re-warm from the vendored repo failed"; }
-[ -f "$M2/org/apache/commons/commons-text/1.10.0/commons-text-1.10.0.jar" ] || fail "re-warm did not populate \$M2"
+LEAF=".socket/vendor/maven2/org/apache/commons/commons-text/__SV__"
+VJAR="$LEAF/commons-text-__SV__.jar"
+[ -f "$M2/org/apache/commons/commons-text/1.10.0/commons-text-1.10.0.jar" ] \
+  || fail "the warm upstream 1.10.0 the crawler reads is gone"
 
 # 1. Idempotency: a re-run reports already_vendored, pom.xml + jar byte-stable.
 POM_SHA_BEFORE=$(sha256sum pom.xml | cut -d' ' -f1)
@@ -325,6 +311,7 @@ assert_summary /tmp/revert.json removed 1
 cmp -s pom.xml /workspace/snap/pom.prevendor \
   || { diff /workspace/snap/pom.prevendor pom.xml >&2 || true; fail "revert did not byte-restore pom.xml"; }
 [ ! -e .socket/vendor ] || fail ".socket/vendor must be fully removed after revert"
+[ ! -e .mvn ] || fail ".mvn must be removed after revert"
 echo "===REVERT VERIFIED==="
 
 # 3. Re-vendor after revert succeeds and rewires again.
@@ -334,38 +321,40 @@ RC=$?; cat /tmp/revendor2.err >&2
 assert_summary /tmp/revendor2.json applied 1
 assert_summary /tmp/revendor2.json failed 0
 [ -f "$VJAR" ] || fail "re-vendor did not recreate the vendored jar"
-grep -q "<id>socket-patch-vendor-__UUID__</id>" pom.xml || fail "re-vendor did not re-add the <repository>"
+grep -q '<version>__SV__</version>' pom.xml || fail "re-vendor did not re-pin the version"
 echo "===REVENDOR VERIFIED==="
 exit 0
 "#;
 
-/// Host-side independent oracle on the bind-mounted project: the `pom.xml`
-/// `<repository>` wiring and the `.jar.sha1` sidecar (== sha1 of the mounted
-/// vendored jar). The in-container asserts and these would both have to be
-/// wrong in the same way for a mis-wired project to pass.
+/// Host-side independent oracle on the bind-mounted project: the pinned
+/// `<version>` and fallback repository in `pom.xml`, `.mvn/maven.config`,
+/// and the `.jar.sha1` sidecar (== sha1 of the mounted vendored jar). The
+/// in-container asserts and these would both have to be wrong in the same
+/// way for a mis-wired project to pass.
 fn assert_pom_and_sidecar_from_host(host_dir: &std::path::Path) {
     use sha1::{Digest as _, Sha1};
 
     let proj = host_dir.join("proj");
     let pom = std::fs::read_to_string(proj.join("pom.xml")).expect("read mounted pom.xml");
+    for needle in [
+        format!("<version>{SV}</version>"),
+        "<id>socket-patch-vendor</id>".to_string(),
+        "<checksumPolicy>fail</checksumPolicy>".to_string(),
+    ] {
+        assert!(
+            pom.contains(&needle),
+            "host oracle: pom.xml lacks {needle}\n{pom}"
+        );
+    }
+    let config =
+        std::fs::read_to_string(proj.join(".mvn/maven.config")).expect("read .mvn/maven.config");
     assert!(
-        pom.contains(&format!("<id>socket-patch-vendor-{UUID}</id>")),
-        "host oracle: pom.xml <repository> id\n{pom}"
-    );
-    assert!(
-        pom.contains(&format!(
-            "file://${{project.basedir}}/.socket/vendor/maven/{UUID}"
-        )),
-        "host oracle: pom.xml file:// vendored url\n{pom}"
-    );
-    assert!(
-        pom.contains("<checksumPolicy>fail</checksumPolicy>"),
-        "host oracle: pom.xml checksumPolicy=fail\n{pom}"
+        config.contains("-Dmaven.repo.local.tail="),
+        "host oracle: maven.config\n{config}"
     );
 
-    let jar_rel = format!(
-        ".socket/vendor/maven/{UUID}/org/apache/commons/commons-text/1.10.0/commons-text-1.10.0.jar"
-    );
+    let jar_rel =
+        format!(".socket/vendor/maven2/org/apache/commons/commons-text/{SV}/commons-text-{SV}.jar");
     let jar = std::fs::read(proj.join(&jar_rel)).expect("read mounted vendored jar");
     let want = hex::encode(Sha1::digest(&jar));
     let sidecar = std::fs::read_to_string(proj.join(format!("{jar_rel}.sha1")))
@@ -413,11 +402,11 @@ fn assert_vex_attested_from_host(host_dir: &std::path::Path) {
 /// the host binary runs against a wiremock patch API serving the SAME
 /// record the ledger embedded:
 ///
-/// * manifest deleted, ledger kept → attested `(vendored)` offline and online;
-/// * ledgers deleted, online → attested from the pom wiring + the committed
-///   jar + the API record; embedded `vendor --vex` with no manifest too;
-/// * `--offline` without a ledger → `record_unavailable`, zero requests;
-/// * the pom reverted to its pre-vendor bytes (ledger + artifact kept) →
+/// * manifest deleted, ledger kept → attested `(vendored)` offline and
+///   online, and by the embedded `vendor --vex` with no manifest;
+/// * ledgers deleted → nothing is discovered (a planner pin is attributed
+///   only through its ledger), online or offline;
+/// * the pom reverted to its pre-vendor bytes (ledger + tree kept) →
 ///   `vendor_unwired`, with and without `--no-verify`.
 fn assert_manifestless_vex_from_host(host_dir: &std::path::Path) {
     use vex_e2e_common::*;
@@ -425,6 +414,7 @@ fn assert_manifestless_vex_from_host(host_dir: &std::path::Path) {
     let copy = tempfile::tempdir().expect("host copy");
     let fresh = copy.path().join("fresh");
     copy_tree(&src.join(".socket"), &fresh.join(".socket"));
+    copy_tree(&src.join(".mvn"), &fresh.join(".mvn"));
     std::fs::copy(src.join("pom.xml"), fresh.join("pom.xml")).expect("copy pom.xml");
     strip_manifest(&fresh);
 
@@ -470,11 +460,6 @@ fn assert_manifestless_vex_from_host(host_dir: &std::path::Path) {
     assert_eq!(out.code, Some(0), "ledger, online: {out}");
     assert_attested(out.doc(), PURL, UUID, Marker::Vendored, &vulns);
 
-    strip_ledgers(&fresh);
-    let out = run_vex(&binary(), &fresh, &run);
-    assert_eq!(out.code, Some(0), "no ledgers, online: {out}");
-    assert_attested(out.doc(), PURL, UUID, Marker::Vendored, &vulns);
-    assert!(api.view_requests(UUID) >= 1, "the record came from the API");
     let out = run_vex(
         &binary(),
         &fresh,
@@ -485,12 +470,19 @@ fn assert_manifestless_vex_from_host(host_dir: &std::path::Path) {
     );
     assert_eq!(out.code, Some(0), "vendor --vex, no manifest: {out}");
     assert_attested(out.doc(), PURL, UUID, Marker::Vendored, &vulns);
-    let out = offline(false);
-    assert_eq!(out.code, Some(1), "no ledgers, offline: {out}");
-    assert_not_attested(&out.envelope, PURL, "record_unavailable");
+
+    strip_ledgers(&fresh);
+    for out in [run_vex(&binary(), &fresh, &run), offline(false)] {
+        assert_eq!(out.code, Some(2), "no ledgers: {out}");
+        assert_eq!(
+            out.envelope["error"]["code"], "manifest_not_found",
+            "no ledgers: {out}"
+        );
+    }
 
     std::fs::copy(host_dir.join("snap/pom.prevendor"), fresh.join("pom.xml"))
         .expect("restore the pre-vendor pom");
+    std::fs::remove_dir_all(fresh.join(".mvn")).expect("drop .mvn");
     std::fs::write(&ledger_path, &ledger_bytes).unwrap();
     for no_verify in [false, true] {
         let out = offline(no_verify);
@@ -538,7 +530,7 @@ fn maven_vendor_fresh_checkout_install_and_revert() {
     assert_pom_and_sidecar_from_host(&host_dir);
     assert_vex_attested_from_host(&host_dir);
 
-    // Stage 2 — fresh checkout, network cut, file:// vendored repo the only
+    // Stage 2 — fresh checkout, network cut, the committed tree the only
     // source of the patched target (+ RED + TAMPER probes).
     let out = run_in_image_network_none(IMAGE, &host_dir, &with_purl_env(&render(STAGE2)));
     assert_stage_markers(
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_maven_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_maven_build.rs
index 7e834bb2c..e20f94a79 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_maven_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_maven_build.rs
@@ -1,37 +1,41 @@
-//! Real-Maven vendored-mode (`vendor`) host capstone, ending in
-//! manifest-less VEX — the host twin of the docker `docker_e2e_vendor_maven`
-//! (which pins the image's Debian Maven); this one runs whichever Maven the
-//! `SOCKET_PATCH_MAVEN_E2E_*` gates select, so every Maven line in the
-//! version matrix proves the same chain:
+//! Real-Maven vendored-mode (`vendor`) host capstone for a single-module
+//! project, ending in manifest-less VEX — the host twin of the docker
+//! `docker_e2e_vendor_maven` (which pins the image's Debian Maven); this one
+//! runs whichever Maven the `SOCKET_PATCH_MAVEN_E2E_*` gates select, so
+//! every Maven line in the version matrix proves the same chain:
 //!
 //!   1. A consumer depending on `commons-text:1.10.0` (parent pom + the
 //!      commons-lang3 transitive) is resolved from Maven Central into a
 //!      per-test local repository — the ACTUAL registry bytes.
 //!   2. A marker patch on the cached jar's `META-INF/NOTICE.txt` is staged
 //!      (manifest + blob, real git-sha256 before/after hashes), and
-//!      `vendor --json --vex` (the real binary) downloads the patched jar
-//!      into the committed maven2 tree `.socket/vendor/maven/<uuid>/…`,
-//!      inserts the `socket-patch-vendor-<uuid>` file:// `<repository>`, and
-//!      attests in-run `(vendored)`.
-//!   3. FRESH CHECKOUT: only `pom.xml` + `.socket/` travel (the manifest and
-//!      blobs deleted — the detached / depscan-PR shape), commons-text is
-//!      purged from the local repository, and Maven resolves the patched jar
-//!      from the file:// repository: byte-identical to the committed jar,
-//!      NOTICE patched, the transitive declared by the vendored upstream pom.
+//!      `vendor --json --vex` (the real binary) plans the single-module pom
+//!      as a reactor of one (#973): the suffixed tree
+//!      `.socket/vendor/maven2/<g>/<a>/<v>-socket.<hex8>/`, the pinned
+//!      `<version>`, `.mvn/maven.config` and the fallback
+//!      `socket-patch-vendor` file repository. With no Maven Wrapper the run
+//!      carries both wrapper-less `vendor_jvm_degraded` warnings
+//!      (`maven_f_outside_root`, `maven_mirror_of_all`), and attests in-run
+//!      `(vendored)`.
+//!   3. FRESH CHECKOUT: only `pom.xml`, `.mvn/` and `.socket/` travel (the
+//!      manifest and blobs deleted). Maven builds against the WARM local
+//!      repository (Central's pristine 1.10.0 still cached: it cannot shadow
+//!      the suffixed version) and again behind a `mirrorOf external:*`
+//!      mirror: the resolved jar is the committed one, NOTICE patched, the
+//!      transitive declared by the suffixed upstream pom.
 //!   4. MANIFEST-LESS VEX over the fresh checkout (`vex_e2e_common`):
-//!      * the ledger present → attested online and `--offline`;
-//!      * the ledgers deleted, online → attested from the pom wiring + the
-//!        committed artifact + the API record; `--offline` →
-//!        `record_unavailable`, ZERO requests;
-//!      * embedded `vendor --vex` and `apply --vex` with no manifest attest
-//!        the same;
-//!      * a tampered committed member → `vendor_hash_mismatch`;
-//!      * the pom reverted to the registry version (ledger + artifact left
-//!        behind) → `vendor_unwired`, with and without `--no-verify`; Maven
-//!        then resolves Central's pristine jar and nothing attests.
-//!   5. TAMPER probe: a mutated committed jar with its stale `.sha1` is
-//!      never consumed (`checksumPolicy=fail`).
-//!   6. The source project's `vendor --revert` byte-restores `pom.xml`, and
+//!      * the ledger present → attested online and `--offline`, and by the
+//!        embedded `vendor --vex` and `apply --vex` with no manifest;
+//!      * the ledgers deleted → nothing attests (a planner pin is never
+//!        attributed without its ledger);
+//!      * a tampered committed member, re-signed or with its stale `.sha1`
+//!        → never attested. Maven before 3.9.2 rejects the stale-`.sha1`
+//!        copy on the fallback repository's `checksumPolicy=fail`; 3.9.2+
+//!        builds it from the unchecked repository tail;
+//!      * the pom reverted to the registry version (ledger + tree left
+//!        behind) → `vendor_unwired`, with and without `--no-verify`, and
+//!        Maven resolves Central's pristine jar.
+//!   5. The source project's `vendor --revert` restores every byte, and
 //!      nothing is left to attest.
 //!
 //! Gated like the other real-toolchain capstones: `#[ignore]` (network to
@@ -62,12 +66,33 @@ fn vulns() -> [(&'static str, &'static [&'static str]); 1] {
     [(GHSA, &[CVE])]
 }
 
-fn leaf_rel() -> String {
-    format!(".socket/vendor/maven/{UUID}/{GROUP_PATH}/{ARTIFACT}/{VERSION}")
+/// The suffixed version the planner pins: `<base>-socket.<uuid hex8>`.
+const SV: &str = "1.10.0-socket.5e6f7081";
+
+fn tree_rel() -> String {
+    format!(".socket/vendor/maven2/{GROUP_PATH}/{ARTIFACT}/{SV}")
 }
 
 fn jar_rel() -> String {
-    format!("{}/{ARTIFACT}-{VERSION}.jar", leaf_rel())
+    format!("{}/{ARTIFACT}-{SV}.jar", tree_rel())
+}
+
+/// Every file under `dir` (relative, forward slashes) with its bytes.
+fn snapshot(dir: &Path) -> std::collections::BTreeMap<String, Vec<u8>> {
+    fn walk(base: &Path, dir: &Path, out: &mut std::collections::BTreeMap<String, Vec<u8>>) {
+        for entry in std::fs::read_dir(dir).unwrap() {
+            let path = entry.unwrap().path();
+            if path.is_dir() {
+                walk(base, &path, out);
+            } else {
+                let rel = path.strip_prefix(base).unwrap().to_string_lossy();
+                out.insert(rel.replace('\\', "/"), std::fs::read(&path).unwrap());
+            }
+        }
+    }
+    let mut out = std::collections::BTreeMap::new();
+    walk(dir, dir, &mut out);
+    out
 }
 
 /// `socket-patch <args>` with ambient `SOCKET_*` scrubbed and the per-test
@@ -132,11 +157,18 @@ fn stage_manifest(proj: &Path, member_before: &[u8], member_after: &[u8]) {
     .unwrap();
 }
 
-fn purge(m2: &Path) {
-    let dir = m2.join(GROUP_PATH).join(ARTIFACT);
-    if dir.exists() {
-        std::fs::remove_dir_all(&dir).unwrap();
-    }
+/// The commons-text jar Maven copied into `<cwd>/<out_rel>`, and its name.
+fn copied_jar(cwd: &Path, out_rel: &str) -> (String, Vec<u8>) {
+    let dir = cwd.join(out_rel);
+    let hits: Vec<_> = std::fs::read_dir(&dir)
+        .unwrap_or_else(|e| panic!("{}: {e}", dir.display()))
+        .flatten()
+        .map(|e| e.file_name().to_string_lossy().into_owned())
+        .filter(|n| n.starts_with(&format!("{ARTIFACT}-")))
+        .collect();
+    assert_eq!(hits.len(), 1, "{}: {hits:?}", dir.display());
+    let bytes = std::fs::read(dir.join(&hits[0])).unwrap();
+    (hits[0].clone(), bytes)
 }
 
 fn vex_run(m2: &Path) -> VexRun {
@@ -161,7 +193,7 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
     write_settings(&settings, &[]);
 
     // 1. The ACTUAL registry bytes.
-    let Some((jar, _pom)) = warm_fixture(SUITE, &mvn, &proj, &m2, &settings) else {
+    let Some((jar, upstream_pom)) = warm_fixture(SUITE, &mvn, &proj, &m2, &settings) else {
         return;
     };
     let pristine_pom = std::fs::read(proj.join("pom.xml")).unwrap();
@@ -169,6 +201,7 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
     // 2. Stage the patch, then the real writer.
     let (orig, patched) = patched_member(&jar, UUID);
     stage_manifest(&proj, &orig, &patched);
+    let before = snapshot(&proj);
     let (code, env, stderr) = socket(
         &proj,
         &m2,
@@ -187,43 +220,103 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
     assert_eq!(code, Some(0), "vendor --vex: {env}\n{stderr}");
     assert_eq!(env["summary"]["applied"], 1, "{env}");
     assert_eq!(env["summary"]["failed"], 0, "{env}");
+    // No Maven Wrapper: both wrapper-less warnings, whatever Maven runs.
+    let text = env.to_string();
+    for reason in ["maven_f_outside_root", "maven_mirror_of_all"] {
+        assert!(
+            text.contains("vendor_jvm_degraded") && text.contains(&format!("reason: {reason}: ")),
+            "{reason}: {env}"
+        );
+    }
+    assert!(!text.contains("vendor_maven_local_cache_shadow"), "{env}");
     let embedded: serde_json::Value =
         serde_json::from_slice(&std::fs::read(proj.join("embedded.vex.json")).unwrap()).unwrap();
     assert_attested(&embedded, &purl(), UUID, Marker::Vendored, &vulns());
+    std::fs::remove_file(proj.join("embedded.vex.json")).unwrap();
+
     let vendored_jar = std::fs::read(proj.join(jar_rel())).unwrap();
     assert_jar_patched(&vendored_jar, &patched, "vendored jar");
-    assert_ne!(vendored_jar, jar, "the committed jar is not Central's jar");
+    assert_eq!(
+        std::fs::read_to_string(proj.join(format!("{}.sha1", jar_rel()))).unwrap(),
+        sha1_hex(&vendored_jar)
+    );
+    let tree_pom =
+        std::fs::read_to_string(proj.join(format!("{}/{ARTIFACT}-{SV}.pom", tree_rel()))).unwrap();
+    assert_eq!(
+        tree_pom.replace(SV, VERSION),
+        String::from_utf8_lossy(&upstream_pom),
+        "the suffixed pom differs from upstream only in its version"
+    );
     let wired = std::fs::read_to_string(proj.join("pom.xml")).unwrap();
-    assert!(
-        wired.contains(&format!("<id>socket-patch-vendor-{UUID}</id>"))
-            && wired.contains(&format!(
-                "file://${{project.basedir}}/.socket/vendor/maven/{UUID}"
-            ))
-            && wired.contains("<checksumPolicy>fail</checksumPolicy>"),
-        "vendored repository wiring:\n{wired}"
+    for needle in [
+        format!("<version>{SV}</version>"),
+        "<id>socket-patch-vendor</id>".to_string(),
+        "<url>file://${maven.multiModuleProjectDirectory}/.socket/vendor/maven2</url>".to_string(),
+        "<checksumPolicy>fail</checksumPolicy>".to_string(),
+    ] {
+        assert!(wired.contains(&needle), "pom.xml lacks {needle}:\n{wired}");
+    }
+    assert!(!wired.contains(".socket/vendor/maven/"), "{wired}");
+    assert_eq!(
+        std::fs::read_to_string(proj.join(".mvn/maven.config")).unwrap(),
+        "-Daether.offline.protocols=file\n\
+         -Dmaven.repo.local.tail=${session.rootDirectory}/.socket/vendor/maven2\n"
     );
+    assert!(!proj.join(".socket/vendor/maven").exists());
     assert!(proj.join(".socket/vendor/state.json").is_file());
 
-    // 3. Fresh checkout (no manifest, no blobs) + real resolve.
+    // An in-sync re-run writes nothing.
+    let vendored = snapshot(&proj);
+    let (code, env, stderr) = socket(
+        &proj,
+        &m2,
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+    );
+    assert_eq!(code, Some(0), "re-vendor: {env}\n{stderr}");
+    assert_eq!(
+        snapshot(&proj),
+        vendored,
+        "an in-sync re-run writes nothing"
+    );
+
+    // 3. Fresh checkout (no manifest, no blobs) + real resolve against the
+    // WARM local repository: Central's 1.10.0 cannot shadow the pin.
     let fresh = root.join("fresh");
     fresh_checkout(&proj, &fresh);
     strip_manifest(&fresh);
     std::fs::remove_dir_all(fresh.join(".socket/blobs")).unwrap();
-    let _ = std::fs::remove_file(fresh.join("embedded.vex.json"));
-    purge(&m2);
-    let out = mvn.copy_dependencies(&fresh, &m2, &settings, "target/dep");
-    assert!(ok(&out), "fresh resolve failed:\n{}", dump(&out));
-    let resolved =
-        std::fs::read(fresh.join(format!("target/dep/{ARTIFACT}-{VERSION}.jar"))).unwrap();
-    assert_eq!(
-        resolved, vendored_jar,
-        "Maven must consume the committed file:// jar, not Central's"
-    );
     assert!(
-        fresh.join(format!("target/dep/{TRANSITIVE_JAR}")).is_file(),
-        "the vendored upstream pom's transitive must resolve"
+        repo_dir(&m2, VERSION)
+            .join(format!("{ARTIFACT}-{VERSION}.jar"))
+            .is_file(),
+        "the local repository stays warm"
+    );
+    let mirrored = root.join("mirrored-settings.xml");
+    write_settings(
+        &mirrored,
+        &[("external:*", "https://repo.maven.apache.org/maven2")],
     );
-    std::fs::remove_dir_all(fresh.join("target")).unwrap();
+    for (label, settings) in [("warm", &settings), ("mirrorOf external:*", &mirrored)] {
+        let out = mvn.copy_dependencies(&fresh, &m2, settings, "target/dep");
+        assert!(ok(&out), "{label}: fresh resolve failed:\n{}", dump(&out));
+        let (name, resolved) = copied_jar(&fresh, "target/dep");
+        assert_eq!(name, format!("{ARTIFACT}-{SV}.jar"), "{label}");
+        assert_eq!(
+            resolved, vendored_jar,
+            "{label}: Maven must consume the committed jar, not Central's"
+        );
+        assert!(
+            fresh.join(format!("target/dep/{TRANSITIVE_JAR}")).is_file(),
+            "{label}: the suffixed upstream pom's transitive must resolve"
+        );
+        std::fs::remove_dir_all(fresh.join("target")).unwrap();
+    }
 
     // 4. MANIFEST-LESS VEX.
     let api = PatchApi::start(vec![(
@@ -232,7 +325,7 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
     )]);
     let run = vex_run(&m2);
 
-    // Ledger present: online and offline.
+    // Ledger present: online, offline, and embedded with no manifest.
     let out = run_vex(
         &binary(),
         &fresh,
@@ -256,42 +349,6 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
     assert_eq!(out.code, Some(0), "{out}");
     assert_attested(out.doc(), &purl(), UUID, Marker::Vendored, &vulns());
     quiet.assert_no_requests();
-
-    // Ledgers gone: pom wiring + committed artifact + the API record.
-    let ledger = std::fs::read(fresh.join(".socket/vendor/state.json")).unwrap();
-    strip_ledgers(&fresh);
-    let before = api.view_requests(UUID);
-    let out = run_vex(
-        &binary(),
-        &fresh,
-        &VexRun {
-            proxy_url: Some(api.uri()),
-            ..run.clone()
-        },
-    );
-    assert_eq!(out.code, Some(0), "{out}");
-    assert_attested(out.doc(), &purl(), UUID, Marker::Vendored, &vulns());
-    assert!(
-        api.view_requests(UUID) > before,
-        "the record came from the API"
-    );
-
-    // Offline, no ledgers: record_unavailable with zero network.
-    let quiet = PatchApi::empty();
-    let out = run_vex(
-        &binary(),
-        &fresh,
-        &VexRun {
-            offline: true,
-            proxy_url: Some(quiet.uri()),
-            ..run.clone()
-        },
-    );
-    assert_eq!(out.code, Some(1), "{out}");
-    assert_not_attested(&out.envelope, &purl(), "record_unavailable");
-    quiet.assert_no_requests();
-
-    // Embedded, no manifest: `vendor --vex` and `apply --vex`.
     for via in [VexVia::Vendor, VexVia::Apply] {
         let out = run_vex(
             &binary(),
@@ -307,24 +364,9 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
         assert_attested(out.doc(), &purl(), UUID, Marker::Vendored, &vulns());
     }
 
-    // A tampered committed member, RE-SIGNED (its `.sha1` updated): Maven
-    // consumes it (the transport check passes), but the record's afterHash
-    // no longer holds — omitted.
-    let committed = fresh.join(jar_rel());
-    let sidecar = fresh.join(format!("{}.sha1", jar_rel()));
-    let good_sidecar = std::fs::read(&sidecar).unwrap();
-    let tampered = jar_with_member(&vendored_jar, MEMBER, b"tampered\n");
-    std::fs::write(&committed, &tampered).unwrap();
-    std::fs::write(&sidecar, sha1_hex(&tampered)).unwrap();
-    purge(&m2);
-    let out = mvn.copy_dependencies(&fresh, &m2, &settings, "target/resigned");
-    assert!(ok(&out), "{}", dump(&out));
-    assert_eq!(
-        std::fs::read(fresh.join(format!("target/resigned/{ARTIFACT}-{VERSION}.jar"))).unwrap(),
-        tampered,
-        "a re-signed committed jar is what Maven builds"
-    );
-    let _ = std::fs::remove_dir_all(fresh.join("target"));
+    // Ledgers gone: a planner pin is never attributed without its ledger.
+    let ledger = std::fs::read(fresh.join(".socket/vendor/state.json")).unwrap();
+    strip_ledgers(&fresh);
     let out = run_vex(
         &binary(),
         &fresh,
@@ -333,48 +375,19 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
             ..run.clone()
         },
     );
-    assert_eq!(out.code, Some(1), "{out}");
-    assert_not_attested(&out.envelope, &purl(), "vendor_hash_mismatch");
+    assert_ne!(out.code, Some(0), "{out}");
+    assert_absent(out.doc.as_ref(), &purl());
+    std::fs::write(fresh.join(".socket/vendor/state.json"), &ledger).unwrap();
 
-    // 5. TAMPER probe: the mutated jar with its ORIGINAL (now stale)
-    // `.sha1` is never what the build consumes — and never attested.
-    std::fs::write(&sidecar, &good_sidecar).unwrap();
-    purge(&m2);
-    let out = mvn.copy_dependencies(&fresh, &m2, &settings, "target/tamper");
-    let consumed = std::fs::read(fresh.join(format!("target/tamper/{ARTIFACT}-{VERSION}.jar")));
-    match consumed {
-        // Maven moved on to the next repository (Central) after the
-        // checksum failure: the build gets the PRISTINE registry jar.
-        Ok(bytes) => {
-            eprintln!(
-                "TAMPER (Maven {}): checksum-rejected file:// copy, fell back to Central",
-                mvn.version
-            );
-            assert!(ok(&out), "{}", dump(&out));
-            assert_eq!(
-                bytes,
-                jar,
-                "a tampered committed jar must never be consumed:\n{}",
-                dump(&out)
-            );
-            assert!(
-                dump(&out).to_ascii_lowercase().contains("checksum"),
-                "the file:// copy was rejected on its checksum:\n{}",
-                dump(&out)
-            );
-        }
-        Err(_) => {
-            eprintln!(
-                "TAMPER (Maven {}): resolve failed on the checksum",
-                mvn.version
-            );
-            assert!(
-                !ok(&out) && dump(&out).to_ascii_lowercase().contains("checksum"),
-                "a checksum failure:\n{}",
-                dump(&out)
-            );
-        }
-    }
+    // A tampered committed member, RE-SIGNED (its `.sha1` updated): what
+    // the build may consume no longer carries the record's afterHash, so
+    // it is never attested.
+    let committed = fresh.join(jar_rel());
+    let sidecar = fresh.join(format!("{}.sha1", jar_rel()));
+    let good_sidecar = std::fs::read(&sidecar).unwrap();
+    let tampered = jar_with_member(&vendored_jar, MEMBER, b"tampered\n");
+    std::fs::write(&committed, &tampered).unwrap();
+    std::fs::write(&sidecar, sha1_hex(&tampered)).unwrap();
     let out = run_vex(
         &binary(),
         &fresh,
@@ -383,89 +396,42 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
             ..run.clone()
         },
     );
-    assert_eq!(out.code, Some(2), "stale sidecar = no reference: {out}");
+    assert_ne!(out.code, Some(0), "a tampered tree must not attest: {out}");
     assert_absent(out.doc.as_ref(), &purl());
-    std::fs::write(&committed, &vendored_jar).unwrap();
-    let _ = std::fs::remove_dir_all(fresh.join("target"));
 
-    // Sidecar-only damage: the committed jar is intact (its members still
-    // hash-verify against the record) but its `.sha1` — the checksum
-    // `checksumPolicy=fail` validates — no longer matches (or is gone, e.g.
-    // a `*.sha1` gitignore). Maven rejects the file:// copy and builds
-    // Central's PRISTINE jar, so the vendored wiring is not what runs and
-    // nothing may be attested — with or without the ledger.
-    for (label, damage) in [("stale", Some("0".repeat(40))), ("missing", None)] {
-        match &damage {
-            Some(text) => std::fs::write(&sidecar, text).unwrap(),
-            None => std::fs::remove_file(&sidecar).unwrap(),
-        }
-        purge(&m2);
-        let out = mvn.copy_dependencies(&fresh, &m2, &settings, "target/sidecar");
-        if let Ok(bytes) =
-            std::fs::read(fresh.join(format!("target/sidecar/{ARTIFACT}-{VERSION}.jar")))
-        {
-            assert_eq!(
-                bytes,
-                jar,
-                "{label} sidecar: Maven must not consume the file:// jar:\n{}",
-                dump(&out)
-            );
-        }
-        let _ = std::fs::remove_dir_all(fresh.join("target"));
-        let out = run_vex(
-            &binary(),
-            &fresh,
-            &VexRun {
-                proxy_url: Some(api.uri()),
-                ..run.clone()
-            },
+    // TAMPER probe: the mutated jar with its ORIGINAL (now stale) `.sha1`.
+    // Before 3.9.2 Maven reads the fallback `checksumPolicy=fail` file
+    // repository, so the checksum rejects the copy. 3.9.2+ reads the
+    // `maven.repo.local.tail` tree, a local repository Maven does not
+    // checksum, so the tampered jar is what builds; there the gate is the
+    // committed tree's review and VEX, which never attests it (below).
+    // A COLD re-resolve: step 3 cached the suffixed artifact in the local
+    // repository, which Maven serves without re-reading (or re-checksumming)
+    // any remote, so the cached copy is dropped first. Central's pristine
+    // 1.10.0 stays warm (it cannot shadow the suffixed version).
+    std::fs::write(&sidecar, &good_sidecar).unwrap();
+    let cached = repo_dir(&m2, SV);
+    if cached.exists() {
+        std::fs::remove_dir_all(&cached).unwrap();
+    }
+    let out = mvn.copy_dependencies(&fresh, &m2, &settings, "target/tamper");
+    if mvn.numeric() >= vec![3, 9, 2] {
+        assert!(ok(&out), "{}", dump(&out));
+        assert_eq!(
+            copied_jar(&fresh, "target/tamper"),
+            (format!("{ARTIFACT}-{SV}.jar"), tampered.clone()),
+            "Maven {} reads the unchecked repository tail",
+            mvn.version
         );
-        assert_ne!(out.code, Some(0), "{label} sidecar must not attest: {out}");
-        assert_absent(out.doc.as_ref(), &purl());
-        std::fs::write(fresh.join(".socket/vendor/state.json"), &ledger).unwrap();
-        let out = run_vex(
-            &binary(),
-            &fresh,
-            &VexRun {
-                offline: true,
-                proxy_url: Some(PatchApi::empty().uri()),
-                ..run.clone()
-            },
+    } else {
+        assert!(
+            !ok(&out) && dump(&out).to_ascii_lowercase().contains("checksum"),
+            "Maven {}: the fallback repository rejects the stale checksum:\n{}",
+            mvn.version,
+            dump(&out)
         );
-        assert_eq!(out.code, Some(1), "{label} sidecar + ledger: {out}");
-        assert_not_attested(&out.envelope, &purl(), "vendor_unwired");
-        strip_ledgers(&fresh);
     }
-    std::fs::write(&sidecar, &good_sidecar).unwrap();
-
-    // The POM's sidecar is not load-bearing for consumption: a stale
-    // `<a>-<v>.pom.sha1` sends only the descriptor to the next repository
-    // (Central serves the same upstream pom the vendor tree copied
-    // verbatim); the JAR still resolves from the file:// repository, so
-    // the patch still runs and still attests.
-    let pom_sidecar = fresh.join(format!("{}/{ARTIFACT}-{VERSION}.pom.sha1", leaf_rel()));
-    let good_pom_sidecar = std::fs::read(&pom_sidecar).unwrap();
-    std::fs::write(&pom_sidecar, "0".repeat(40)).unwrap();
-    purge(&m2);
-    let out = mvn.copy_dependencies(&fresh, &m2, &settings, "target/pomsidecar");
-    assert!(ok(&out), "{}", dump(&out));
-    let consumed =
-        std::fs::read(fresh.join(format!("target/pomsidecar/{ARTIFACT}-{VERSION}.jar"))).unwrap();
-    eprintln!(
-        "POM SIDECAR (Maven {}): consumed the {} jar",
-        mvn.version,
-        if consumed == vendored_jar {
-            "vendored"
-        } else {
-            "registry"
-        }
-    );
-    assert_eq!(
-        consumed,
-        vendored_jar,
-        "a stale pom sidecar must not divert the jar:\n{}",
-        dump(&out)
-    );
+    let _ = std::fs::remove_dir_all(fresh.join("target"));
     let out = run_vex(
         &binary(),
         &fresh,
@@ -474,15 +440,14 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
             ..run.clone()
         },
     );
-    assert_eq!(out.code, Some(0), "{out}");
-    assert_attested(out.doc(), &purl(), UUID, Marker::Vendored, &vulns());
-    std::fs::write(&pom_sidecar, &good_pom_sidecar).unwrap();
-    let _ = std::fs::remove_dir_all(fresh.join("target"));
+    assert_ne!(out.code, Some(0), "a tampered tree must not attest: {out}");
+    assert_absent(out.doc.as_ref(), &purl());
+    std::fs::write(&committed, &vendored_jar).unwrap();
 
-    // Reverted to the registry version, ledger + artifact left behind:
-    // dead, with and without --no-verify.
+    // Reverted to the registry version, ledger + tree left behind: dead,
+    // with and without --no-verify, and Maven builds Central's jar.
     std::fs::write(fresh.join("pom.xml"), &pristine_pom).unwrap();
-    std::fs::write(fresh.join(".socket/vendor/state.json"), &ledger).unwrap();
+    std::fs::remove_dir_all(fresh.join(".mvn")).unwrap();
     for no_verify in [false, true] {
         let quiet = PatchApi::empty();
         let out = run_vex(
@@ -499,29 +464,15 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
         assert_not_attested(&out.envelope, &purl(), "vendor_unwired");
         assert_absent(out.doc.as_ref(), &purl());
     }
-    // Maven now builds Central's pristine jar; without the ledger nothing
-    // names a patch at all.
-    purge(&m2);
     let out = mvn.copy_dependencies(&fresh, &m2, &settings, "target/reverted");
     assert!(ok(&out), "{}", dump(&out));
     assert_eq!(
-        std::fs::read(fresh.join(format!("target/reverted/{ARTIFACT}-{VERSION}.jar"))).unwrap(),
-        jar,
+        copied_jar(&fresh, "target/reverted"),
+        (format!("{ARTIFACT}-{VERSION}.jar"), jar.clone()),
         "the reverted pom resolves Central's pristine jar"
     );
-    strip_ledgers(&fresh);
-    let out = run_vex(
-        &binary(),
-        &fresh,
-        &VexRun {
-            proxy_url: Some(api.uri()),
-            ..run.clone()
-        },
-    );
-    assert_eq!(out.code, Some(2), "{out}");
-    assert_eq!(out.envelope["error"]["code"], "manifest_not_found", "{out}");
 
-    // 6. The source project's real revert.
+    // 5. The source project's real revert.
     let (code, env, stderr) = socket(
         &proj,
         &m2,
@@ -535,11 +486,8 @@ fn maven_vendor_fresh_checkout_install_and_manifestless_vex() {
         ],
     );
     assert_eq!(code, Some(0), "vendor --revert: {env}\n{stderr}");
-    assert_eq!(
-        std::fs::read(proj.join("pom.xml")).unwrap(),
-        pristine_pom,
-        "revert byte-restores pom.xml"
-    );
+    assert_eq!(snapshot(&proj), before, "revert restores every byte");
+    assert!(!proj.join(".mvn").exists());
     assert!(!proj.join(".socket/vendor").exists());
     strip_manifest(&proj);
     let out = run_vex(
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
index c79358c1d..8a2199546 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
@@ -2,9 +2,10 @@
 //! `scan --mode hosted` / `get --mode hosted` write (`redirect::
 //! rewrite_maven_pom`: a `-socket.<hex8>` pinned version + a
 //! `socket-patch-<uuid>` repository on the Socket patch server) and the
-//! vendored wiring `vendor` writes (`vendor::maven_repo`: a
+//! vendored wiring the pre-v5 `vendor` wrote (a
 //! `socket-patch-vendor-<uuid>` file:// repository over the committed
-//! `.socket/vendor/maven/<uuid>/` maven2 tree) are attested from the
+//! `.socket/vendor/maven/<uuid>/` maven2 tree; v5 vendors through the
+//! suffixed JVM planner, attested from its ledger) are attested from the
 //! project files alone — no `.socket/manifest.json` and (except where a cell
 //! says otherwise) no `.socket/vendor/state.json` / `redirect-state.json`
 //! ledger — and never falsely.
@@ -1257,54 +1258,6 @@ fn assert_doc_attests(doc: &Value, uuid: &str, purl: &str, marker: &str) {
     );
 }
 
-/// After a real writer ran: the three standalone shapes — manifest gone
-/// (ledger record, offline), manifest AND ledger gone (API record online;
-/// `record_unavailable` offline), then the wiring reverted with the ledger
-/// restored (`*_unwired`).
-#[allow(clippy::too_many_arguments)]
-fn standalone_after_writer(
-    fx: &Fx,
-    ledger: &str,
-    uuid: &str,
-    record_purl: &str,
-    marker: &str,
-    api_view: Value,
-    revert: &dyn Fn(&Fx),
-    dead_reason: &str,
-) {
-    fx.rm(".socket/manifest.json");
-    fx.rm(".socket/blobs");
-    assert!(
-        fx.cwd.join(ledger).exists(),
-        "the writer persisted {ledger}"
-    );
-    let (code, env) = fx.vex(&["--offline"]);
-    assert_attested(fx, code, &env, uuid, record_purl, marker);
-
-    let saved = std::fs::read(fx.cwd.join(ledger)).unwrap();
-    fx.rm(ledger);
-    let api = Api::serve(vec![(uuid, api_view)]);
-    let (code, env) = fx.vex(&["--proxy-url", &api.uri()]);
-    assert_attested(fx, code, &env, uuid, record_purl, marker);
-    let before = api.requests();
-    let (code, env) = fx.vex(&["--offline", "--proxy-url", &api.uri()]);
-    assert_omitted(
-        code,
-        &env,
-        record_purl,
-        "record_unavailable",
-        "writer, no ledger",
-    );
-    assert_eq!(api.requests(), before);
-
-    fx.put(ledger, &saved);
-    revert(fx);
-    for extra in [&["--offline"][..], &["--offline", "--no-verify"][..]] {
-        let (code, env) = fx.vex(extra);
-        assert_omitted(code, &env, record_purl, dead_reason, "writer, reverted");
-    }
-}
-
 /// After the real HOSTED writer ran: v5 hosted mode left NO ledger, so
 /// the lock pin is the only hosted state — offline there is no local
 /// record (`record_unavailable`, zero requests), online the API's record
@@ -1342,14 +1295,21 @@ fn standalone_after_hosted_writer(
     }
 }
 
-/// A plausible upstream pom for the cached artifact (the maven vendor
-/// backend copies it verbatim next to the rebuilt jar).
+/// A plausible upstream pom for the cached artifact (the vendored tree
+/// serves it with only its version suffixed).
 const COMMONS_TEXT_POM: &str = "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n  \
     <modelVersion>4.0.0</modelVersion>\n  <groupId>org.apache.commons</groupId>\n  \
     <artifactId>commons-text</artifactId>\n  <version>1.10.0</version>\n</project>\n";
 
+/// The real `vendor` writer on a single-module pom (#973): the suffixed
+/// planner wiring (a `jvm` ledger entry, `<version>-socket.<hex8>` pin and
+/// the `.socket/vendor/maven2` tree) attests in-run and, with no manifest,
+/// from its ledger offline. A planner pin is attributed only through its
+/// ledger: without one nothing is discovered, online or offline. The pom
+/// reverted to the registry version with the ledger left behind is
+/// `vendor_unwired`.
 #[test]
-fn maven_vendor_command_wiring_reattests_without_manifest_or_ledger() {
+fn maven_vendor_command_wiring_reattests_from_its_ledger_only() {
     let fx = Fx::new();
     let v = Vendored::maven();
     let cached = fx.m2().join("org/apache/commons/commons-text/1.10.0");
@@ -1391,23 +1351,50 @@ fn maven_vendor_command_wiring_reattests_without_manifest_or_ledger() {
         MVN_VENDOR_PURL,
         "vendored",
     );
+    let sv = "1.10.0-socket.7b7b7b7b";
     let pom = std::fs::read_to_string(fx.cwd.join("pom.xml")).unwrap();
-    assert!(
-        pom.contains(&format!("<id>socket-patch-vendor-{MVN_VENDOR_UUID}</id>")),
-        "{pom}"
-    );
-    assert!(fx.cwd.join(&v.artifact_rel).is_file(), "{}", v.artifact_rel);
+    assert!(pom.contains(&format!("<version>{sv}</version>")), "{pom}");
+    assert!(!pom.contains("socket-patch-vendor-"), "{pom}");
+    let jar =
+        format!(".socket/vendor/maven2/org/apache/commons/commons-text/{sv}/commons-text-{sv}.jar");
+    assert!(fx.cwd.join(&jar).is_file(), "{jar}");
+    assert!(!fx.cwd.join(&v.artifact_rel).exists(), "{}", v.artifact_rel);
+    let ledger = std::fs::read_to_string(fx.cwd.join(".socket/vendor/state.json")).unwrap();
+    assert!(ledger.contains("\"ecosystem\": \"jvm\""), "{ledger}");
 
-    standalone_after_writer(
+    fx.rm(".socket/manifest.json");
+    fx.rm(".socket/blobs");
+    let (code, env) = fx.vex(&["--offline"]);
+    assert_attested(
         &fx,
-        ".socket/vendor/state.json",
+        code,
+        &env,
         MVN_VENDOR_UUID,
         MVN_VENDOR_PURL,
         "vendored",
-        v.view(),
-        &|fx| fx.put("pom.xml", registry_pom()),
-        "vendor_unwired",
     );
+
+    let saved = std::fs::read(fx.cwd.join(".socket/vendor/state.json")).unwrap();
+    fx.rm(".socket/vendor/state.json");
+    let api = Api::serve(vec![(MVN_VENDOR_UUID, v.view())]);
+    let (code, env) = fx.vex(&["--proxy-url", &api.uri()]);
+    assert_nothing_to_attest(code, &env, "planner wiring, no ledger, online");
+    let (code, env) = fx.vex(&["--offline", "--proxy-url", &api.uri()]);
+    assert_nothing_to_attest(code, &env, "planner wiring, no ledger, offline");
+    assert_eq!(api.requests(), 0, "an unattributed pin never asks the API");
+
+    fx.put(".socket/vendor/state.json", &saved);
+    fx.put("pom.xml", registry_pom());
+    for extra in [&["--offline"][..], &["--offline", "--no-verify"][..]] {
+        let (code, env) = fx.vex(extra);
+        assert_omitted(
+            code,
+            &env,
+            MVN_VENDOR_PURL,
+            "vendor_unwired",
+            "writer, reverted",
+        );
+    }
 }
 
 /// The authenticated API `scan --mode hosted` drives: batch discovery, the
diff --git a/crates/socket-patch-cli/tests/maven_build_common/mod.rs b/crates/socket-patch-cli/tests/maven_build_common/mod.rs
index 1b3385565..c45a15283 100644
--- a/crates/socket-patch-cli/tests/maven_build_common/mod.rs
+++ b/crates/socket-patch-cli/tests/maven_build_common/mod.rs
@@ -167,7 +167,8 @@ impl Mvn {
         Some(Mvn { program, version })
     }
 
-    fn numeric(&self) -> Vec<u32> {
+    /// `[major, minor, patch]` (a pre-release tail such as `-rc-6` dropped).
+    pub fn numeric(&self) -> Vec<u32> {
         self.version
             .split(['.', '-'])
             .take(3)
diff --git a/crates/socket-patch-cli/tests/vendor_ecosystem_fixtures/mod.rs b/crates/socket-patch-cli/tests/vendor_ecosystem_fixtures/mod.rs
index 71bc4a7af..df1178e1a 100644
--- a/crates/socket-patch-cli/tests/vendor_ecosystem_fixtures/mod.rs
+++ b/crates/socket-patch-cli/tests/vendor_ecosystem_fixtures/mod.rs
@@ -308,6 +308,10 @@ type Built = (Vec<(String, String)>, Vec<Patch>);
 
 const U1: &str = "11111111-1111-4111-8111-000000000001";
 const U2: &str = "11111111-1111-4111-8111-000000000002";
+/// Maven's second uuid: a vendored Maven pin is `<version>-socket.<first 8
+/// uuid hex>`, and two patches of the same version whose uuids share those 8
+/// hex digits pin the same string, which the revert cannot tell apart.
+const MAVEN_U2: &str = "22222222-2222-4222-8222-000000000002";
 
 fn npm_install(root: &Path, name: &str, index: &[u8]) {
     let pkg = root.join("node_modules").join(name);
@@ -747,7 +751,7 @@ fn maven(root: &Path, store: &Path) -> Built {
     let p = |name: &str| {
         patch(
             &format!("pkg:maven/org.fx/{name}@1.0.0"),
-            if name == "alpha" { U1 } else { U2 },
+            if name == "alpha" { U1 } else { MAVEN_U2 },
             "META-INF/NOTICE.txt",
             format!("{name} notice\n").as_bytes(),
             format!("{name} notice (patched)\n").as_bytes(),
diff --git a/crates/socket-patch-cli/tests/vendor_group_commit_e2e.rs b/crates/socket-patch-cli/tests/vendor_group_commit_e2e.rs
index 7759a18d6..83db60ce1 100644
--- a/crates/socket-patch-cli/tests/vendor_group_commit_e2e.rs
+++ b/crates/socket-patch-cli/tests/vendor_group_commit_e2e.rs
@@ -244,9 +244,12 @@ fn a_crash_mid_loop_leaves_the_pre_run_commit_points() {
     }
 }
 
+/// Maven is not in the list: its JVM tree is written durably as it goes
+/// (`vendor::jvm::apply::write_plan`), so a Maven run leaves the artifact
+/// barrier nothing to sync and the failpoint first fires after the commit.
 #[test]
 fn a_crash_at_the_artifact_barrier_leaves_the_pre_run_commit_points() {
-    for eco in ["pnpm", "golang", "maven"] {
+    for eco in ["pnpm", "golang", "nuget"] {
         crash_then_rerun(eco, "durability_barrier", true);
     }
 }
diff --git a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
index 241498dc5..20fb20548 100644
--- a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
+++ b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
@@ -1229,36 +1229,142 @@ fn gradle_vendor_428_repair_from_subproject_refuses() {
     assert_eq!(snapshot(root), before);
 }
 
-/// A single-pom root vendored before a Gradle build sat beside it keeps
-/// its single-pom entry: the re-run warns that the Gradle build stays
-/// unpatched and writes no Gradle wiring, `--check` passes, and the
-/// revert restores every byte.
+/// Plant the wiring the retired pre-v5 single-pom backend left in `proj`:
+/// a `<repository>` before `</project>`, its `.socket/vendor/maven/<uuid>`
+/// tree and a `maven_pom_repository` ledger entry for `foo`.
+fn plant_legacy_single_pom(root: &Path, pom: &str) {
+    let repo_id = format!("socket-patch-vendor-{FOO_UUID}");
+    let tree = format!(".socket/vendor/maven/{FOO_UUID}");
+    let at = pom.rfind("</project>").unwrap();
+    let wired = format!(
+        "{}  <repositories>\n    <repository>\n      <id>{repo_id}</id>\n      \
+         <url>file://${{project.basedir}}/{tree}</url>\n      <releases>\n        \
+         <enabled>true</enabled>\n        <checksumPolicy>fail</checksumPolicy>\n      \
+         </releases>\n      <snapshots>\n        <enabled>false</enabled>\n      \
+         </snapshots>\n    </repository>\n  </repositories>\n{}",
+        &pom[..at],
+        &pom[at..]
+    );
+    write(root, "proj/pom.xml", wired.as_bytes());
+    let jar_rel = format!("{tree}/org/example/foo/1.0/foo-1.0.jar");
+    let jar_bytes = jar(b"NOTICE foo\nPATCHED\n");
+    write(root, &format!("proj/{jar_rel}"), &jar_bytes);
+    let state = serde_json::json!({
+        "version": 1,
+        "entries": { purl("foo"): {
+            "ecosystem": "maven",
+            "basePurl": purl("foo"),
+            "uuid": FOO_UUID,
+            "artifact": {
+                "path": jar_rel,
+                "sha256": hex::encode(Sha256::digest(&jar_bytes)),
+                "size": jar_bytes.len(),
+            },
+            "wiring": [{
+                "file": "pom.xml",
+                "kind": "maven_pom_repository",
+                "action": "added",
+                "key": repo_id,
+                "original": pom,
+                "new": wired,
+            }],
+        } },
+    });
+    write(
+        root,
+        "proj/.socket/vendor/state.json",
+        serde_json::to_string_pretty(&state).unwrap().as_bytes(),
+    );
+}
+
+/// #973: a root whose ledger still holds a pre-v5 single-pom entry is
+/// refused whole (`legacy_maven_root`), alone or beside a Gradle build,
+/// with nothing written. `vendor --revert` restores every byte, and the
+/// next vendor plans the root through the suffixed planner.
 #[test]
-fn gradle_vendor_395_legacy_single_pom_entry_is_not_migrated() {
+fn legacy_single_pom_entry_is_refused_until_reverted() {
+    let pom = "<project>\n  <modelVersion>4.0.0</modelVersion>\n  <groupId>com.x</groupId>\n  <artifactId>app</artifactId>\n  <version>1</version>\n  <dependencies>\n    <dependency><groupId>org.example</groupId><artifactId>foo</artifactId><version>1.0</version></dependency>\n  </dependencies>\n</project>\n";
+    for mixed in [false, true] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, Shape::Gradle, &[("foo", FOO_UUID)]);
+        if !mixed {
+            std::fs::remove_file(root.join("proj/settings.gradle")).unwrap();
+            std::fs::remove_dir_all(root.join("proj/app")).unwrap();
+        }
+        write(root, "proj/pom.xml", pom.as_bytes());
+        let pristine = snapshot(root);
+        plant_legacy_single_pom(root, pom);
+        assert_refused(root, "legacy_maven_root", "socket-patch vendor --revert");
+        ok(root, &["vendor", "--revert"]);
+        assert_eq!(snapshot(root), pristine, "mixed={mixed}");
+        let env = ok(root, &["vendor"]);
+        assert_eq!(env["summary"]["applied"], 1, "mixed={mixed}: {env}");
+        assert!(root
+            .join(FOO_MAVEN_TREE)
+            .join("foo-1.0-socket.1d3c1fd2.jar")
+            .is_file());
+        let state = std::fs::read_to_string(root.join("proj/.socket/vendor/state.json")).unwrap();
+        assert!(!state.contains("maven_pom_repository"), "{state}");
+        ok(root, &["vendor", "--revert"]);
+        assert_eq!(snapshot(root), pristine, "mixed={mixed}");
+    }
+}
+
+/// #973: a lone single-module pom with no Maven Wrapper vendors through
+/// the planner: suffixed tree and pin, `.mvn/maven.config`, both
+/// wrapper-less warnings, `--check` and VEX pass, and the revert restores
+/// every byte.
+#[test]
+fn single_module_pom_vendors_through_the_planner() {
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     fixture(root, Shape::Gradle, &[("foo", FOO_UUID)]);
+    std::fs::remove_file(root.join("proj/settings.gradle")).unwrap();
+    std::fs::remove_dir_all(root.join("proj/app")).unwrap();
     write(
         root,
         "proj/pom.xml",
         b"<project>\n  <modelVersion>4.0.0</modelVersion>\n  <groupId>com.x</groupId>\n  <artifactId>app</artifactId>\n  <version>1</version>\n  <dependencies>\n    <dependency><groupId>org.example</groupId><artifactId>foo</artifactId><version>1.0</version></dependency>\n  </dependencies>\n</project>\n",
     );
     let pristine = snapshot(root);
-    let settings = root.join("proj/settings.gradle");
-    let parked = root.join("settings.gradle.parked");
-    std::fs::rename(&settings, &parked).unwrap();
-    ok(root, &["vendor"]);
-    let state = std::fs::read_to_string(root.join("proj/.socket/vendor/state.json")).unwrap();
-    assert!(state.contains("maven_pom_repository"), "{state}");
-    std::fs::rename(&parked, &settings).unwrap();
-    let legacy = snapshot(root);
     let env = ok(root, &["vendor"]);
-    assert!(
-        env.to_string().contains("reason: legacy_maven_root: "),
-        "{env}"
-    );
-    assert_eq!(snapshot(root), legacy, "no Gradle wiring is added");
+    assert_eq!(env["summary"]["applied"], 1, "{env}");
+    let text = env.to_string();
+    for reason in ["maven_f_outside_root", "maven_mirror_of_all"] {
+        assert!(
+            text.contains(&format!("reason: {reason}: ")),
+            "{reason}: {env}"
+        );
+    }
+    assert!(!text.contains("vendor_maven_local_cache_shadow"), "{env}");
+    assert!(root
+        .join(FOO_MAVEN_TREE)
+        .join("foo-1.0-socket.1d3c1fd2.jar")
+        .is_file());
+    assert!(std::fs::read_to_string(root.join("proj/pom.xml"))
+        .unwrap()
+        .contains("1.0-socket.1d3c1fd2"));
+    assert!(root.join("proj/.mvn/maven.config").is_file());
+    assert!(!root.join("proj/.socket/vendor/maven").exists());
+    let again = snapshot(root);
+    ok(root, &["vendor"]);
+    assert_eq!(snapshot(root), again, "an in-sync re-run writes nothing");
     ok(root, &["vendor", "--check"]);
+    let vex = root.join("vex.json");
+    ok(
+        root,
+        &[
+            "vex",
+            "-O",
+            vex.to_str().unwrap(),
+            "--product",
+            "pkg:generic/x@1",
+        ],
+    );
+    let doc: serde_json::Value = serde_json::from_slice(&std::fs::read(&vex).unwrap()).unwrap();
+    assert_eq!(doc["statements"][0]["status"], "not_affected", "{doc}");
+    std::fs::remove_file(vex).unwrap();
     ok(root, &["vendor", "--revert"]);
     assert_eq!(snapshot(root), pristine);
 }
diff --git a/crates/socket-patch-cli/tests/vendor_ledger_schema_e2e.rs b/crates/socket-patch-cli/tests/vendor_ledger_schema_e2e.rs
index 4efd3add1..7db6f500d 100644
--- a/crates/socket-patch-cli/tests/vendor_ledger_schema_e2e.rs
+++ b/crates/socket-patch-cli/tests/vendor_ledger_schema_e2e.rs
@@ -134,7 +134,9 @@ fn new_ledgers_compact_whole_file_snapshots_and_revert() {
         assert_eq!(code, 0, "{eco}: {stdout}\n{stderr}");
         let bytes = std::fs::read(f.root.join(".socket/vendor/state.json")).unwrap();
         let ledger: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
-        let whole_file = ["maven", "nuget", "pylock"].contains(eco);
+        // Maven vendors through the JVM planner (#973), whose fragment
+        // records hold no whole-file snapshot.
+        let whole_file = ["nuget", "pylock"].contains(eco);
         assert_eq!(
             ledger["version"],
             if whole_file { 2 } else { 1 },
@@ -239,7 +241,9 @@ fn strip_sha256_hash_options(bytes: &[u8]) -> Vec<u8> {
 /// same entries the base's version-1 ledger loads to.
 #[tokio::test]
 async fn server_artifacts_preserve_legacy_wiring_shape_and_originals() {
-    for eco in fx::ALL {
+    // Maven now vendors through the suffixed JVM planner (#973); its
+    // legacy fixture is revert-only (`legacy_maven_ledger_is_refused_until_reverted`).
+    for eco in fx::ALL.iter().filter(|eco| **eco != "maven") {
         let mut base_wired = read_tree(&fixtures_dir().join(eco).join("wired"));
         if *eco == "pypi-requirements" {
             // The one intended difference: the base binary pinned its vendor
@@ -313,3 +317,38 @@ async fn server_artifacts_preserve_legacy_wiring_shape_and_originals() {
         }
     }
 }
+
+/// #973: a project still holding the pre-v5 single-POM ledger (the base
+/// binary's `maven_pom_repository` wiring) is refused whole, with nothing
+/// written; `vendor --revert` restores it byte for byte, and the next
+/// vendor plans it through the suffixed JVM planner.
+#[test]
+fn legacy_maven_ledger_is_refused_until_reverted() {
+    let wired = read_tree(&fixtures_dir().join("maven/wired"));
+    let f = Fixture::new("maven");
+    let pristine = tree(&f.root);
+    write_tree(&f.root, &wired);
+    let before = tree(&f.root);
+
+    let (code, stdout, stderr) = f.vendor(&[], &[]);
+    assert_ne!(code, 0, "{stdout}\n{stderr}");
+    assert!(
+        stdout.contains("vendor_jvm_shape_unsupported")
+            && stdout.contains("reason: legacy_maven_root: "),
+        "{stdout}"
+    );
+    assert_eq!(tree(&f.root), before, "the refusal writes nothing");
+
+    let (code, stdout, stderr) = f.vendor(&["--revert"], &[]);
+    assert_eq!(code, 0, "{stdout}\n{stderr}");
+    assert_eq!(tree(&f.root), pristine, "byte-exact revert");
+
+    let (code, stdout, stderr) = f.vendor(&[], &[]);
+    assert_eq!(code, 0, "{stdout}\n{stderr}");
+    let ledger = std::fs::read_to_string(f.root.join(".socket/vendor/state.json")).unwrap();
+    assert!(ledger.contains("\"ecosystem\": \"jvm\""), "{ledger}");
+    assert!(!ledger.contains("maven_pom_repository"), "{ledger}");
+    assert!(std::fs::read_to_string(f.root.join("pom.xml"))
+        .unwrap()
+        .contains("1.0.0-socket.11111111"));
+}
diff --git a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
index eff5c7ab9..481fa789e 100644
--- a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
@@ -3800,7 +3800,10 @@ mod tests {
             </configuration></plugin></plugins></build></project>";
         assert!(!declares_modules(ear));
         let read = |p: &str| (p == "pom.xml").then(|| ear.as_bytes().to_vec());
-        assert_eq!(super::super::detect(&read), Shape::Other);
+        let builds = super::super::detect_builds(&read);
+        assert_eq!(builds.maven, Some(super::super::MavenShape::Single));
+        // A single pom is a reactor of one (#973).
+        assert_eq!(builds.shape(), Shape::MavenReactor);
     }
 
     #[test]
diff --git a/crates/socket-patch-core/src/vendor/jvm/mod.rs b/crates/socket-patch-core/src/vendor/jvm/mod.rs
index c443b57e1..f6eb22b17 100644
--- a/crates/socket-patch-core/src/vendor/jvm/mod.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/mod.rs
@@ -1,7 +1,8 @@
 //! The v5 vendored JVM backend (`docs/design/maven-vendoring.md`).
 //!
-//! Handles multi-module Maven reactors and Gradle builds automatically.
-//! Single-POM builds retain the legacy backend.
+//! Handles every Maven root (a single-module pom is planned as a reactor
+//! of one), Gradle builds, mixed Maven + Gradle roots, sbt builds and
+//! scala-cli directory builds.
 //!
 //! The planners are pure: they read project files through a [`ReadFn`] and
 //! return the full post-vendor bytes of every file they touch plus one
@@ -213,7 +214,8 @@ impl<'a> JvmPatch<'a> {
 /// Which JVM build the project root holds.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Shape {
-    /// A root `pom.xml` that declares `<modules>`.
+    /// A root `pom.xml`, whether it declares `<modules>` or is a single
+    /// module (a reactor of one).
     MavenReactor,
     /// No root `pom.xml`, and a Gradle settings or build script.
     Gradle,
@@ -224,7 +226,7 @@ pub enum Shape {
     Sbt,
     /// A scala-cli directory build ([`scala_cli::detect`]).
     ScalaCli,
-    /// Anything else (including a single-module pom, which stays legacy).
+    /// No root `pom.xml` and no Gradle, sbt or scala-cli build.
     Other,
 }
 
@@ -315,18 +317,18 @@ pub struct Detected {
 }
 
 impl Detected {
-    /// The backend's planner shape: a single pom alone stays on the legacy
-    /// backend; next to a Gradle build it is planned as a one-pom reactor,
-    /// so both halves share one ledger entry.
+    /// The backend's planner shape. Any root pom, single-module or not, is
+    /// planned as a reactor; next to a Gradle build both halves are planned
+    /// together, so they share one ledger entry.
     pub fn shape(&self) -> Shape {
         if let Some(scala) = self.scala {
             return scala;
         }
         match (self.maven, self.gradle) {
             (Some(_), true) => Shape::Mixed,
-            (Some(MavenShape::Reactor), false) => Shape::MavenReactor,
+            (Some(_), false) => Shape::MavenReactor,
             (None, true) => Shape::Gradle,
-            _ => Shape::Other,
+            (None, false) => Shape::Other,
         }
     }
 }
@@ -381,11 +383,17 @@ pub fn plan_with_config(
         }
         Shape::Sbt => sbt::plan(read, patch),
         Shape::ScalaCli => scala_cli::plan(read, patch),
-        Shape::Other => Err(JvmRefusal {
-            code: "vendor_jvm_shape_unsupported",
-            detail: "reason: no_build_file: not a multi-module Maven reactor or a Gradle build"
-                .to_string(),
-        }),
+        Shape::Other => Err(no_build_file_refusal()),
+    }
+}
+
+/// The refusal of a [`Shape::Other`] root.
+pub fn no_build_file_refusal() -> JvmRefusal {
+    JvmRefusal {
+        code: "vendor_jvm_shape_unsupported",
+        detail: "reason: no_build_file: no pom.xml, Gradle, sbt or scala-cli build at the \
+                 project root"
+            .to_string(),
     }
 }
 
@@ -816,7 +824,7 @@ mod tests {
         };
         assert_eq!(detect(&reactor), Shape::MavenReactor);
         let single = |p: &str| (p == "pom.xml").then(|| b"<project></project>".to_vec());
-        assert_eq!(detect(&single), Shape::Other);
+        assert_eq!(detect(&single), Shape::MavenReactor);
         let gradle = |p: &str| (p == "settings.gradle.kts").then(Vec::new);
         assert_eq!(detect(&gradle), Shape::Gradle);
         let empty = |_: &str| None;
@@ -824,7 +832,7 @@ mod tests {
     }
 
     /// #395: a `pom.xml` next to a Gradle build is both, whichever kind of
-    /// pom it is; a single pom alone stays on the legacy backend.
+    /// pom it is; a single pom alone is a reactor of one (#973).
     #[test]
     fn detect_reports_both_builds_of_a_mixed_root() {
         let files = |pom: &'static [u8], gradle: Option<&'static str>| {
@@ -858,7 +866,7 @@ mod tests {
                 Shape::Mixed,
             ),
             (&reactor[..], None, MavenShape::Reactor, Shape::MavenReactor),
-            (&single[..], None, MavenShape::Single, Shape::Other),
+            (&single[..], None, MavenShape::Single, Shape::MavenReactor),
         ] {
             let read = files(pom, gradle);
             let d = detect_builds(&read);
diff --git a/crates/socket-patch-core/src/vendor/jvm/sbt.rs b/crates/socket-patch-core/src/vendor/jvm/sbt.rs
index 5dfe11233..928c12133 100644
--- a/crates/socket-patch-core/src/vendor/jvm/sbt.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/sbt.rs
@@ -60,7 +60,7 @@ fn text<'a>(read: ReadFn<'a>) -> impl Fn(&str) -> Option<String> + 'a {
 }
 
 /// [`Shape::Sbt`] for a directory holding an sbt marker, unless the
-/// project is already vendored through the Maven reactor, the legacy
+/// project is already vendored through the Maven reactor, the pre-v5
 /// single-pom path, the Gradle backend or the scala-cli backend (its wiring
 /// stays on that backend; a new pin there then plans as before).
 pub fn detect(read: ReadFn<'_>) -> Option<Shape> {
@@ -89,8 +89,9 @@ fn scala_cli_wired(read: ReadFn<'_>) -> bool {
     read(super::scala_cli::ROOT_FILE).is_some() || read(super::coursier_tree::INDEX_REL).is_some()
 }
 
-/// The legacy single-pom path (`vendor/maven_repo.rs`, `Shape::Other`)
-/// already wired the root pom: its `<repository>` id.
+/// The pre-v5 single-pom backend already wired the root pom: its
+/// `<repository>` id. The root stays off sbt so that `vendor --revert` can
+/// unwind it first (vendoring it is refused as `legacy_maven_root`).
 fn legacy_pom_wired(read: ReadFn<'_>) -> bool {
     read("pom.xml").is_some_and(|b| {
         let pom = String::from_utf8_lossy(&b);
@@ -102,17 +103,17 @@ fn legacy_pom_wired(read: ReadFn<'_>) -> bool {
     })
 }
 
-/// The Maven reactor backend already wired this root: its tagged block or
-/// pin in the root pom, or its repository tail in `.mvn/maven.config`.
+/// The Maven reactor backend already wired this root (a multi-module
+/// reactor or a single pom): its tagged block or pin in the root pom, or
+/// its repository tail in `.mvn/maven.config`.
 fn reactor_wired(read: ReadFn<'_>) -> bool {
     let Some(pom) = read(layout::POM_FILE).map(|b| String::from_utf8_lossy(&b).into_owned()) else {
         return false;
     };
-    maven_reactor::declares_modules(&pom)
-        && (pom.contains(maven_reactor::BEGIN_MARKER)
-            || pom.contains(maven_reactor::PIN_TAG)
-            || read(maven_reactor::MAVEN_CONFIG)
-                .is_some_and(|c| String::from_utf8_lossy(&c).contains(layout::MAVEN2_TREE)))
+    pom.contains(maven_reactor::BEGIN_MARKER)
+        || pom.contains(maven_reactor::PIN_TAG)
+        || read(maven_reactor::MAVEN_CONFIG)
+            .is_some_and(|c| String::from_utf8_lossy(&c).contains(layout::MAVEN2_TREE))
 }
 
 /// The Gradle backend already wired this root (its settings apply line).
@@ -734,8 +735,9 @@ mod tests {
         let read = |p: &str| scala.get(p).cloned();
         assert_eq!(detect(&read), None);
         assert_eq!(super::super::detect(&read), Shape::ScalaCli);
-        // A single-module pom the legacy path already wired stays legacy
-        // (`Shape::Other`); an unwired one beside sbt routes to sbt.
+        // A single-module pom the pre-v5 path already wired stays off sbt
+        // (a Maven root, refused until reverted); an unwired one beside
+        // sbt routes to sbt.
         let legacy = build(
             "1.9.9",
             &[(
@@ -747,7 +749,7 @@ mod tests {
         );
         let read = |p: &str| legacy.get(p).cloned();
         assert_eq!(detect(&read), None);
-        assert_eq!(super::super::detect(&read), Shape::Other);
+        assert_eq!(super::super::detect(&read), Shape::MavenReactor);
         // A Gradle build with an unrelated `project/build.properties` is
         // not sbt-shaped.
         let stray: BTreeMap<String, Vec<u8>> = [
diff --git a/crates/socket-patch-core/src/vendor/maven_repo.rs b/crates/socket-patch-core/src/vendor/maven_repo.rs
index 40d8a5888..6ac807c18 100644
--- a/crates/socket-patch-core/src/vendor/maven_repo.rs
+++ b/crates/socket-patch-core/src/vendor/maven_repo.rs
@@ -1,4 +1,15 @@
-use std::collections::HashMap;
+//! Vendored Maven: the router into the [`super::jvm`] backend, which plans
+//! every Maven root (a single-module pom is a reactor of one), Gradle,
+//! mixed, sbt and scala-cli build, plus the JVM orchestration around it
+//! (upstream sourcing and verification, the committed-tree hot path) that
+//! #972 moves next to the planners.
+//!
+//! The pre-v5 single-pom backend (a same-GAV `<repository>` in `pom.xml`
+//! serving `.socket/vendor/maven/<uuid>/`) is retired. Only its revert
+//! remains ([`revert_maven_opts`] over `maven_pom_repository` records), so
+//! an older ledger still unwinds byte for byte; vendoring a root whose
+//! ledger holds such an entry is refused (`legacy_maven_root`).
+
 use std::path::{Path, PathBuf};
 
 use serde_json::Value;
@@ -6,42 +17,41 @@ use sha1::Sha1;
 use sha2::{Digest as _, Sha256};
 
 use crate::constants::SOCKET_DIR;
-use crate::manifest::schema::{PatchFileInfo, PatchRecord};
-use crate::patch::apply::{ApplyResult, PatchSources};
-use crate::patch::copy_tree::remove_tree;
+use crate::manifest::schema::PatchRecord;
+use crate::patch::apply::PatchSources;
 use crate::utils::fs::{
     atomic_write_artifact, atomic_write_bytes_preserving_mode, read_regular_to_bytes,
     read_regular_to_string,
 };
 use crate::utils::purl::{build_maven_purl, parse_maven_purl};
 use crate::utils::socket_dir::remove_tree_and_prune;
-use crate::vendor::jvm::layout::{self, is_path_safe};
+use crate::vendor::jvm::layout;
 
 use super::common::{
-    already_patched_result, any_live_file_references, done, failed_result,
-    prune_empty_vendor_levels, read_zip_artifact, refused, synthesized_result,
-    zip_bytes_match_after_hashes,
+    already_patched_result, any_live_file_references, done, failed_result, refused,
+    synthesized_result, zip_bytes_match_after_hashes,
 };
 use super::path::vendor_uuid_dir_rel;
 use super::service_fetch::{service_archive_copy, ServiceCopy};
-use super::state::{
-    write_marker_or_warn, VendorArtifact, VendorEntry, VendorMarker, WiringAction, WiringRecord,
-};
+use super::state::{VendorArtifact, VendorEntry, WiringAction, WiringRecord};
 use super::{RevertOpts, RevertOutcome, VendorOutcome, VendorServiceConfig, VendorWarning};
 
-/// The project file this backend wires (always at the project root).
+/// The project file the pre-v5 backend wired (always at the project root).
 const PROJECT_POM: &str = "pom.xml";
 
-/// Wiring-record discriminator. The record carries the WHOLE-FILE pre/post
-/// `pom.xml` snapshot (the authoritative revert record); its `key` is the
-/// repository id we added, which the revert ownership gate keys off.
+/// The pre-v5 wiring-record discriminator. The record carries the
+/// WHOLE-FILE pre/post `pom.xml` snapshot (the authoritative revert
+/// record); its `key` is the repository id added, which the revert
+/// ownership gate keys off.
 const REPO_WIRING_KIND: &str = "maven_pom_repository";
 
-/// The id prefix of the vendored `<repository>` (`socket-patch-vendor-<uuid>`).
+/// The id prefix of the pre-v5 vendored `<repository>`
+/// (`socket-patch-vendor-<uuid>`).
 pub(crate) const VENDOR_REPO_ID_PREFIX: &str = "socket-patch-vendor-";
 
-/// The url prefix of the vendored `<repository>`: the project root, so the
-/// `.socket/vendor/maven/<uuid>` tree after it resolves on any checkout.
+/// The url prefix of the pre-v5 vendored `<repository>`: the project root,
+/// so the `.socket/vendor/maven/<uuid>` tree after it resolves on any
+/// checkout.
 pub(crate) const VENDOR_REPO_URL_PREFIX: &str = "file://${project.basedir}/";
 
 /// Bound on a pom download from the registry — a pom is dependency metadata
@@ -63,190 +73,30 @@ const MAVEN_USER_AGENT: &str = "Apache-Maven/3.9.11 (Java 17.0.16; Windows 11 10
 #[cfg(not(any(target_os = "macos", target_os = "windows")))]
 const MAVEN_USER_AGENT: &str = "Apache-Maven/3.9.11 (Java 17.0.16; Linux 6.8.0)";
 
-/// Everything [`vendor_maven`] decides before it can first ask the patch
-/// service: the coordinate guards, the no-op of an empty patch, the project
-/// pom.xml refusals, and whether pom.xml already wires an in-sync artifact.
-/// The download plan evaluates the same function ahead of the vendor loop
-/// ([`service_preflight`]).
-struct MavenPrelude {
-    group_id: String,
-    artifact_id: String,
-    version: String,
-    uuid_dir_rel: String,
-    group_path: String,
-    leaf_rel: String,
-    jar_leaf: String,
-    pom_leaf: String,
-    jar_copy_rel: String,
-    uuid_dir: PathBuf,
-    leaf_dir: PathBuf,
-    jar_path: PathBuf,
-    repo_id: String,
-    pom_xml_path: PathBuf,
-    pom_xml_text: String,
-    /// pom.xml already carries this uuid's `<repository>`.
-    wired: bool,
-    /// ...and the committed jar/pom/sidecars are in sync (the hot path,
-    /// which never asks the service).
-    in_sync: bool,
-}
-
-async fn maven_prelude(
-    purl: &str,
-    project_root: &Path,
-    record: &PatchRecord,
-) -> Result<MavenPrelude, VendorOutcome> {
-    // ── coordinates ──────────────────────────────────────────────────────
-    let Some((group_id, artifact_id, version)) = parse_maven_purl(purl) else {
-        return Err(refused(
-            "unsafe_coordinates",
-            format!("not a maven purl: {purl}"),
-        ));
-    };
-    let (group_id, artifact_id, version) = (
-        group_id.to_string(),
-        artifact_id.to_string(),
-        version.to_string(),
-    );
-    let (group_id, artifact_id, version) =
-        (group_id.as_str(), artifact_id.as_str(), version.as_str());
-    // SECURITY: `uuid`, `group_id`, `artifact_id`, and `version` come from
-    // committed, tamper-able manifest data. They key the uuid dir vendor
-    // creates and `--revert` deletes, the nested maven2 path, the vendored
-    // filenames, and — via `pom.xml` — an XML attribute value. Reject anything
-    // that could traverse out of `.socket/vendor/maven/` fail-closed before any
-    // disk access.
-    let Some(uuid_dir_rel) = vendor_uuid_dir_rel("maven", &record.uuid) else {
-        return Err(refused(
-            "unsafe_coordinates",
-            format!("non-canonical patch uuid {:?}", record.uuid),
-        ));
-    };
-    // Each dot-delimited groupId segment must be a safe path segment on its
-    // own (which also rejects an empty groupId and leading/trailing/double
-    // dots), as must the artifactId and version.
-    if !is_path_safe(group_id, artifact_id, version) {
-        return Err(refused(
-            "unsafe_coordinates",
-            format!("unsafe maven coordinates `{group_id}:{artifact_id}` @ `{version}`"),
-        ));
-    }
-
-    let group_path = layout::group_path(group_id);
-    let leaf_rel = format!(
-        "{uuid_dir_rel}/{}",
-        layout::version_dir(group_id, artifact_id, version)
-    );
-    let jar_leaf = layout::file_name(artifact_id, version, None, "jar");
-    let pom_leaf = layout::file_name(artifact_id, version, None, "pom");
-    let jar_copy_rel = format!("{leaf_rel}/{jar_leaf}");
-    let uuid_dir = project_root.join(&uuid_dir_rel);
-    let leaf_dir = project_root.join(&leaf_rel);
-    // Join the full forward-slash rel rather than `leaf_dir.join(&jar_leaf)`:
-    // the joined form puts an OS separator (`\` on Windows) before the leaf
-    // while every other reported path keeps the rel's forward slashes —
-    // `package_path` reports (and tests compare) this as a display string.
-    let jar_path = project_root.join(&jar_copy_rel);
-    let repo_id = format!("{VENDOR_REPO_ID_PREFIX}{}", record.uuid);
-
-    // A patch with no files is meaningless to vendor: no-op success, no edits.
-    if record.files.is_empty() {
-        return Err(done(
-            synthesized_result(purl, &jar_path, Vec::new(), true, None),
-            None,
-            Vec::new(),
-        ));
-    }
-
-    // ── project pom.xml: presence + aggregator/gradle refusals ────────────
-    let pom_xml_path = project_root.join(PROJECT_POM);
-    let pom_xml_text: Option<String> = match read_regular_to_string(&pom_xml_path).await {
-        Ok(t) => Some(t),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
-        Err(e) => {
-            return Err(refused(
-                "vendor_maven_pom_unreadable",
-                format!("unreadable {}: {e}", pom_xml_path.display()),
-            ));
-        }
-    };
-    let Some(pom_xml_text) = pom_xml_text else {
-        // No project pom.xml: a gradle-only project has no <repositories> to
-        // wire (and Gradle ignores it); anything else is not a Maven project.
-        if layout::has_build(project_root, layout::BuildTool::Gradle) {
-            return Err(refused(
-                "vendor_gradle_unsupported",
-                "this is a Gradle project (no pom.xml); vendoring wires a Maven \
-                 <repository>, which Gradle does not consume",
-            ));
-        }
-        return Err(refused(
-            "vendor_maven_pom_project_missing",
-            format!("no {PROJECT_POM} at the project root to wire a vendored <repository> into"),
-        ));
-    };
-    if declares_modules(&pom_xml_text) {
-        return Err(refused(
-            "vendor_maven_multimodule_unsupported",
-            "the root pom.xml declares <modules> (a multi-module aggregator); \
-             ${project.basedir} would resolve to each submodule, not the root, so a \
-             file:// vendored repository cannot be wired here",
-        ));
-    }
-
-    // Wired = our `<repository>` id where Maven reads it: a commented-out
-    // or profile-scoped block serves nothing (the same masking the
-    // forward writer's anchors use), so it must not take the hot path.
-    let wired = find_wireable_anchor(&pom_xml_text, &repo_id).is_some();
-    let in_sync = wired && artifact_in_sync(&leaf_dir, &jar_leaf, &pom_leaf, &record.files).await;
-    Ok(MavenPrelude {
-        group_id: group_id.to_string(),
-        artifact_id: artifact_id.to_string(),
-        version: version.to_string(),
-        uuid_dir_rel,
-        group_path,
-        leaf_rel,
-        jar_leaf,
-        pom_leaf,
-        jar_copy_rel,
-        uuid_dir,
-        leaf_dir,
-        jar_path,
-        repo_id,
-        pom_xml_path,
-        pom_xml_text,
-        wired,
-        in_sync,
-    })
-}
-
 /// Whether [`vendor_maven`] — a wet run with the service enabled — asks the
 /// patch service for `record`: past every refusal and skip it raises first
-/// (`not_build_root`, and for a JVM shape [`jvm_prelude`]'s coordinate,
-/// ledger and sbt / scala-cli gate stops), not the empty patch, and not
-/// answered by the in-sync hot path. The vendor loop's download plan
-/// consults this.
+/// (`not_build_root`, `legacy_maven_root`, `no_build_file`, and
+/// [`jvm_prelude`]'s coordinate, ledger and sbt / scala-cli gate stops),
+/// not the empty patch, and not answered by the committed-tree hot path.
+/// The vendor loop's download plan consults this.
 pub(crate) async fn service_preflight(
     purl: &str,
     project_root: &Path,
     record: &PatchRecord,
 ) -> Option<crate::api::client::PlannedDownload> {
-    if not_build_root(project_root).is_some() {
+    if not_build_root(project_root).is_some() || legacy_root(project_root).await {
         return None;
     }
-    if let Some(shape) = jvm_shape(project_root).await {
-        jvm_prelude(shape, purl, project_root, record).await.ok()?;
-        (!record.files.is_empty()).then_some(())?;
-        jvm_committed_patch(shape, purl, project_root, record)
-            .await
-            .is_none()
-            .then_some(())?;
-    } else {
-        maven_prelude(purl, project_root, record)
-            .await
-            .ok()
-            .filter(|p| !p.in_sync)?;
+    let shape = detect_shape(project_root);
+    if shape == super::jvm::Shape::Other {
+        return None;
     }
+    jvm_prelude(shape, purl, project_root, record).await.ok()?;
+    (!record.files.is_empty()).then_some(())?;
+    jvm_committed_patch(shape, purl, project_root, record)
+        .await
+        .is_none()
+        .then_some(())?;
     // `service_archive_copy` checks the archive's members against the
     // afterHashes before writing it verbatim.
     Some(crate::api::client::PlannedDownload {
@@ -255,14 +105,19 @@ pub(crate) async fn service_preflight(
     })
 }
 
-/// Vendor a Maven package: rebuild a patched `.jar` under a committed maven2
-/// repository at `.socket/vendor/maven/<uuid>/`, copy the real upstream pom
-/// beside it, and wire the project `pom.xml` with a `<repository>` serving it
-/// (see the module doc).
+/// Vendor a Maven package through the [`super::jvm`] backend: every Maven
+/// root (a single-module pom is a reactor of one), Gradle build, mixed
+/// root, sbt and scala-cli build gets a suffixed tree under
+/// `.socket/vendor/` and the planner's wiring.
+///
+/// Refused, with nothing written: a project that is not its build's root
+/// (`not_build_root`), a root whose ledger still holds a pre-v5
+/// `<repository>` entry (`legacy_maven_root`, see [`legacy_root`]), and a
+/// root with no JVM build at all (`no_build_file`).
 ///
 /// `installed_dir` is the crawler's version dir
-/// (`~/.m2/repository/<g>/<a>/<v>/`), which holds the cached pristine
-/// `<a>-<v>.jar` the rebuild extracts from and the `<a>-<v>.pom` copied verbatim.
+/// (`~/.m2/repository/<g>/<a>/<v>/`), the first place the upstream pom
+/// and jar are looked for.
 #[allow(clippy::too_many_arguments)]
 pub async fn vendor_maven(
     purl: &str,
@@ -270,7 +125,7 @@ pub async fn vendor_maven(
     project_root: &Path,
     record: &PatchRecord,
     sources: &PatchSources<'_>,
-    vendored_at: &str,
+    _vendored_at: &str,
     dry_run: bool,
     force: bool,
     service: Option<&VendorServiceConfig>,
@@ -278,252 +133,26 @@ pub async fn vendor_maven(
     if let Some(detail) = not_build_root(project_root) {
         return refused("vendor_jvm_shape_unsupported", detail);
     }
-    if let Some(shape) = jvm_shape(project_root).await {
-        return vendor_maven_jvm(
-            shape,
-            purl,
-            installed_dir,
-            project_root,
-            record,
-            sources,
-            dry_run,
-            force,
-            service,
-        )
-        .await;
+    if legacy_root(project_root).await {
+        return refused("vendor_jvm_shape_unsupported", legacy_root_detail());
+    }
+    let shape = detect_shape(project_root);
+    if shape == super::jvm::Shape::Other {
+        let refusal = super::jvm::no_build_file_refusal();
+        return refused(refusal.code, refusal.detail);
     }
-    let mut outcome = vendor_maven_single(
+    vendor_maven_jvm(
+        shape,
         purl,
         installed_dir,
         project_root,
         record,
         sources,
-        vendored_at,
         dry_run,
         force,
         service,
     )
-    .await;
-    if legacy_mixed_root(project_root).await {
-        if let VendorOutcome::Done { warnings, .. } = &mut outcome {
-            warnings.push(VendorWarning::new(
-                super::jvm::gradle::DEGRADED,
-                format!(
-                    "reason: legacy_maven_root: pom.xml is vendored through its <repository>, \
-                     which the Gradle build beside it never reads, so that build stays \
-                     unpatched; {} to wire both builds",
-                    super::common::REVERT_ALL_AND_REVENDOR
-                ),
-            ));
-        }
-    }
-    outcome
-}
-
-/// The single-pom backend of [`vendor_maven`].
-#[allow(clippy::too_many_arguments)]
-async fn vendor_maven_single(
-    purl: &str,
-    installed_dir: &Path,
-    project_root: &Path,
-    record: &PatchRecord,
-    sources: &PatchSources<'_>,
-    vendored_at: &str,
-    dry_run: bool,
-    force: bool,
-    service: Option<&VendorServiceConfig>,
-) -> VendorOutcome {
-    let MavenPrelude {
-        group_id,
-        artifact_id,
-        version,
-        uuid_dir_rel,
-        group_path,
-        leaf_rel,
-        jar_leaf,
-        pom_leaf,
-        jar_copy_rel,
-        uuid_dir,
-        leaf_dir,
-        jar_path,
-        repo_id,
-        pom_xml_path,
-        pom_xml_text,
-        wired,
-        in_sync,
-    } = match maven_prelude(purl, project_root, record).await {
-        Ok(prelude) => prelude,
-        Err(outcome) => return outcome,
-    };
-    let (group_id, artifact_id, version) =
-        (group_id.as_str(), artifact_id.as_str(), version.as_str());
-
-    // The local-cache shadow is inherent to Maven's resolution order, so the
-    // advisory is emitted on every run (including dry runs and the idempotent
-    // hot path) — a warm ~/.m2 copy silently wins over the vendored artifact.
-    let shadow_warning = local_cache_shadow_warning(group_id, artifact_id, version, &group_path);
-
-    // ── idempotent hot path ──────────────────────────────────────────────
-    // pom.xml already carries our <repository> and the committed jar/pom/
-    // sidecars are all in sync → touch nothing, report AlreadyPatched. `entry`
-    // stays `None`: the first run's ledger entry holds the only copy of the
-    // verbatim pre-vendor pom.xml, and re-recording here would clobber it.
-    if wired {
-        if in_sync {
-            return done(
-                already_patched_result(purl, &jar_path, &record.files),
-                None,
-                vec![shadow_warning],
-            );
-        }
-        // Wired but the committed artifact is missing/stale: rebuild the
-        // ARTIFACT only. pom.xml is already correct, and the full path would
-        // re-record the live vendored pom.xml as `original`, breaking revert.
-        if !dry_run {
-            let mut warnings: Vec<VendorWarning> = vec![shadow_warning];
-            let (jar_bytes, mut result) = match materialise_and_write(
-                purl,
-                installed_dir,
-                &uuid_dir,
-                &leaf_dir,
-                &jar_leaf,
-                &pom_leaf,
-                &jar_path,
-                group_id,
-                artifact_id,
-                version,
-                record,
-                sources,
-                force,
-                service,
-                &mut warnings,
-            )
-            .await
-            {
-                Ok(pair) => pair,
-                Err(outcome) => return *outcome,
-            };
-            if !result.success {
-                return done(result, None, warnings);
-            }
-            result.package_path = jar_path.display().to_string();
-            warnings.push(VendorWarning::new(
-                "vendor_artifact_rebuilt",
-                format!(
-                    "the committed vendored artifact for {artifact_id}@{version} was missing or \
-                     stale; rebuilt at {leaf_rel} (pom.xml untouched)"
-                ),
-            ));
-            // The rebuilt jar may differ byte-wise from the one the ledger
-            // fingerprinted (a service ↔ local flip): hand back a refreshed
-            // entry. Its wiring is empty ON PURPOSE — the caller's
-            // `carry_forward_wiring` (same uuid) re-attaches the first run's
-            // records, the only copy of the verbatim pre-vendor pom.xml.
-            let entry = maven_entry(
-                build_maven_purl(group_id, artifact_id, version),
-                record,
-                jar_copy_rel,
-                &jar_bytes,
-                Vec::new(),
-            );
-            return done(result, Some(entry), warnings);
-        }
-        // Dry runs fall through to the verify-only preview below.
-    }
-
-    if dry_run {
-        if let Err(outcome) =
-            super::service_fetch::preview_service(service, record, |bytes, dest| {
-                super::registry_fetch::extract_zip(bytes, dest, false)
-            })
-            .await
-        {
-            return *outcome;
-        }
-        return done(
-            super::common::preview_result(purl, &jar_path, &record.files),
-            None,
-            vec![shadow_warning],
-        );
-    }
-
-    // ── materialise the patched jar + real pom + sidecars ─────────────────
-    let mut warnings: Vec<VendorWarning> = vec![shadow_warning];
-    let (jar_bytes, mut result) = match materialise_and_write(
-        purl,
-        installed_dir,
-        &uuid_dir,
-        &leaf_dir,
-        &jar_leaf,
-        &pom_leaf,
-        &jar_path,
-        group_id,
-        artifact_id,
-        version,
-        record,
-        sources,
-        force,
-        service,
-        &mut warnings,
-    )
     .await
-    {
-        Ok(pair) => pair,
-        Err(outcome) => return *outcome,
-    };
-    if !result.success {
-        // The rebuild left the result un-successful (and cleaned up its own
-        // partial artifact); pom.xml was never touched.
-        return done(result, None, warnings);
-    }
-    result.package_path = jar_path.display().to_string();
-
-    // ── pom.xml wiring (runs last) ────────────────────────────────────────
-    let new_pom_xml = match build_repo_edit(&pom_xml_text, &repo_id, &uuid_dir_rel) {
-        Ok(text) => text,
-        Err(detail) => {
-            let _ = remove_tree(&uuid_dir).await;
-            prune_empty_vendor_levels(&uuid_dir).await;
-            result.success = false;
-            result.error = Some(detail);
-            return done(result, None, warnings);
-        }
-    };
-    if let Err(e) = atomic_write_bytes_preserving_mode(&pom_xml_path, new_pom_xml.as_bytes()).await
-    {
-        let _ = remove_tree(&uuid_dir).await;
-        prune_empty_vendor_levels(&uuid_dir).await;
-        result.success = false;
-        result.error = Some(format!("failed to write {}: {e}", pom_xml_path.display()));
-        return done(result, None, warnings);
-    }
-
-    // ── marker + ledger entry ─────────────────────────────────────────────
-    let base_purl = build_maven_purl(group_id, artifact_id, version);
-    let marker = VendorMarker::new("maven", &base_purl, record, vendored_at);
-    write_marker_or_warn(&uuid_dir, &marker, &mut warnings).await;
-
-    // The single wiring record is the authoritative revert record: it carries
-    // the whole-file pre/post pom.xml snapshot. `Added` because we ADD a
-    // <repository> (the pom.xml itself always pre-existed — a gradle-only /
-    // pom-less project is refused above); revert restores the `original` bytes
-    // when the live pom.xml still carries our repo id.
-    let entry = maven_entry(
-        base_purl,
-        record,
-        jar_copy_rel,
-        &jar_bytes,
-        vec![WiringRecord {
-            file: PROJECT_POM.to_string(),
-            kind: REPO_WIRING_KIND.to_string(),
-            action: WiringAction::Added,
-            key: Some(repo_id),
-            original: Some(Value::String(pom_xml_text)),
-            new: Some(Value::String(new_pom_xml)),
-        }],
-    );
-
-    done(result, Some(entry), warnings)
 }
 
 /// The ledger entry for a vendored jar: `wiring` is the pom.xml record on a
@@ -564,7 +193,8 @@ fn maven_entry(
     }
 }
 
-/// Revert a Maven vendor entry: surgically remove our `<repository>` from
+/// Revert a Maven vendor entry. A JVM entry goes to the planner's revert;
+/// a pre-v5 entry has its `<repository>` surgically removed from
 /// `pom.xml` (restoring the whole verbatim original only on the byte-identical
 /// fast path — otherwise excising just our block so sibling patches and user
 /// edits survive) and remove the validated uuid dir. A drifted live pom.xml —
@@ -684,31 +314,30 @@ pub async fn revert_maven_opts(
     outcome
 }
 
-// ── v5 JVM backend (reactors, Gradle) ─────────────────────────────────
+// ── v5 JVM backend ─────────────────────────────────────────────────
 
-/// Route reactors, Gradle builds and mixed roots to the JVM backend.
-async fn jvm_shape(project_root: &Path) -> Option<super::jvm::Shape> {
-    let reader = super::jvm::apply::ProjectReader::new(project_root);
-    let shape = super::jvm::detect(&|rel: &str| reader.read(rel));
-    if shape == super::jvm::Shape::Other || legacy_mixed_root(project_root).await {
-        return None;
-    }
-    Some(shape)
+/// The `legacy_maven_root` refusal detail (see [`legacy_root`]).
+fn legacy_root_detail() -> String {
+    format!(
+        "reason: legacy_maven_root: pom.xml is still vendored through the pre-v5 \
+         <repository> wiring; {}",
+        super::common::REVERT_ALL_AND_REVENDOR
+    )
 }
 
-/// A single-pom root beside a Gradle build whose ledger already holds a
-/// single-pom (`<repository>`) entry. Such roots routed to the single-pom
-/// backend before mixed roots were planned as one JVM entry (#395), and
-/// nothing migrates that wiring: a JVM entry would carry the legacy record
-/// forward (same uuid) or orphan its `<repository>` and tree (new uuid). The
-/// whole root stays on the single-pom backend until it is reverted.
-async fn legacy_mixed_root(project_root: &Path) -> bool {
+/// The planner shape of the project root (see [`super::jvm::detect`]).
+fn detect_shape(project_root: &Path) -> super::jvm::Shape {
     let reader = super::jvm::apply::ProjectReader::new(project_root);
-    let builds = super::jvm::detect_builds(&|rel: &str| reader.read(rel));
-    if builds.maven != Some(super::jvm::MavenShape::Single) || !builds.gradle {
-        return false;
-    }
-    // An unreadable ledger is refused by the JVM backend itself.
+    super::jvm::detect(&|rel: &str| reader.read(rel))
+}
+
+/// The root's ledger still holds a pre-v5 single-pom entry (a
+/// `maven_pom_repository` record). Its revert restores a whole-file pom
+/// snapshot, which planner edits on the same pom would make unsafe, and
+/// nothing migrates it, so every Maven vendoring of the root is refused
+/// until `vendor --revert` has unwound it. An unreadable ledger is left to
+/// the JVM backend's own `vendor_state_unreadable` refusal.
+async fn legacy_root(project_root: &Path) -> bool {
     super::state::load_state(project_root)
         .await
         .is_ok_and(|state| {
@@ -937,12 +566,14 @@ impl LocalSources {
     }
 }
 
-/// The vendored sbt / scala-cli gate for `purl` over the project at
-/// `project_root`, for a caller about to restore a hosted pin upstream (a
-/// takeover or an eject) before vendoring: `Err((code, detail))` when the
-/// gate would stop the patch (a skip or a refusal), so the caller keeps the
-/// hosted wiring instead of ending neither hosted nor vendored. `Ok` for
-/// any other project shape or a non-Maven purl.
+/// The vendored refusals and sbt / scala-cli gate for `purl` over the
+/// project at `project_root`, for a caller about to restore a hosted pin
+/// upstream (a takeover or an eject) before vendoring: `Err((code,
+/// detail))` when [`vendor_maven`] would stop the patch before writing
+/// anything (`not_build_root`, `legacy_maven_root`, or a gate skip or
+/// refusal), so the caller keeps the hosted wiring instead of ending
+/// neither hosted nor vendored. `Ok` for any other project or a non-Maven
+/// purl.
 pub async fn jvm_gate_preflight(
     project_root: &Path,
     purl: &str,
@@ -950,9 +581,13 @@ pub async fn jvm_gate_preflight(
     let Some((g, a, v)) = parse_maven_purl(purl) else {
         return Ok(());
     };
-    let Some(shape) = jvm_shape(project_root).await else {
-        return Ok(());
-    };
+    if let Some(detail) = not_build_root(project_root) {
+        return Err(("vendor_jvm_shape_unsupported", detail));
+    }
+    if legacy_root(project_root).await {
+        return Err(("vendor_jvm_shape_unsupported", legacy_root_detail()));
+    }
+    let shape = detect_shape(project_root);
     super::jvm::sbt_gate::for_shape(shape, project_root, &g, &a, &v)
         .map(|_| ())
         .map_err(|stop| stop.code_and_detail(purl))
@@ -1760,111 +1395,6 @@ async fn collect_metadata_artifacts(
     Ok(())
 }
 
-// ── materialisation (service download) ──────────────────────────
-
-/// Produce the patched jar bytes + the real upstream pom, then write both (with
-/// their `.sha1` sidecars) into the maven2 leaf dir. Returns `(jar_bytes,
-/// ApplyResult)`, or a terminal [`VendorOutcome`] to bubble.
-#[allow(clippy::too_many_arguments)]
-async fn materialise_and_write(
-    purl: &str,
-    installed_dir: &Path,
-    uuid_dir: &Path,
-    leaf_dir: &Path,
-    jar_leaf: &str,
-    pom_leaf: &str,
-    jar_path: &Path,
-    group_id: &str,
-    artifact_id: &str,
-    version: &str,
-    record: &PatchRecord,
-    _sources: &PatchSources<'_>,
-    _force: bool,
-    service: Option<&VendorServiceConfig>,
-    warnings: &mut Vec<VendorWarning>,
-) -> Result<(Vec<u8>, ApplyResult), Box<VendorOutcome>> {
-    let (jar_bytes, result) =
-        match service_archive_copy(service, record, artifact_id, ".jar", warnings).await {
-            ServiceCopy::Used(bytes) => {
-                (bytes, already_patched_result(purl, jar_path, &record.files))
-            }
-            ServiceCopy::HardFail(outcome) => return Err(outcome),
-        };
-    // The REAL upstream pom (transitive-deps correctness). A miss is terminal:
-    // refuse rather than fabricate a minimal pom.
-    let pom_bytes = match acquire_upstream_pom(
-        installed_dir,
-        group_id,
-        artifact_id,
-        version,
-        service,
-        warnings,
-    )
-    .await
-    {
-        Ok(bytes) => bytes,
-        Err(detail) => return Err(Box::new(refused("vendor_maven_pom_unavailable", detail))),
-    };
-
-    // Write jar + pom + their sha1 sidecars into the maven2 leaf dir.
-    if let Err(e) = write_maven_artifact(leaf_dir, jar_leaf, &jar_bytes, pom_leaf, &pom_bytes).await
-    {
-        let _ = remove_tree(uuid_dir).await;
-        prune_empty_vendor_levels(uuid_dir).await;
-        return Ok((Vec::new(), failed_result(purl, jar_path, e)));
-    }
-    Ok((jar_bytes, result))
-}
-
-/// Acquire the REAL upstream pom bytes: the cached `~/.m2` copy first (the
-/// common case — the package was resolved locally), then a maven2 registry
-/// download when the service is enabled. An `Err(detail)` maps to a
-/// `vendor_maven_pom_unavailable` refusal — we NEVER author a minimal pom (it
-/// would drop the artifact's transitive dependencies).
-async fn acquire_upstream_pom(
-    installed_dir: &Path,
-    group_id: &str,
-    artifact_id: &str,
-    version: &str,
-    service: Option<&VendorServiceConfig>,
-    warnings: &mut Vec<VendorWarning>,
-) -> Result<Vec<u8>, String> {
-    let local = installed_dir.join(format!("{artifact_id}-{version}.pom"));
-    match read_regular_to_bytes(&local).await {
-        Ok(bytes) => return Ok(bytes),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-        Err(e) => return Err(format!("unreadable local pom {}: {e}", local.display())),
-    }
-
-    // No local pom (fresh clone / service-sourced jar). Download it from the
-    // maven2 registry when the service is enabled. A fresh reqwest client is
-    // used (never the Socket API client) so no API token leaks to a third-party
-    // registry — the pom is dependency metadata, trusted by transport, whereas
-    // the security-critical jar was integrity-verified by the patch service.
-    let can_fetch = service.is_some_and(|cfg| cfg.service_enabled());
-    if !can_fetch {
-        return Err(format!(
-            "no upstream pom for {group_id}:{artifact_id}:{version} in the local Maven cache \
-             and the vendoring service is disabled/offline; refusing to author a minimal pom \
-             (it would drop transitive dependencies)"
-        ));
-    }
-    let url = layout::registry_url(group_id, artifact_id, version, None, "pom");
-    match fetch_pom_bytes(&url).await {
-        Ok(bytes) => {
-            warnings.push(VendorWarning::new(
-                "vendor_maven_pom_downloaded",
-                format!("downloaded the upstream pom for {artifact_id}@{version} from {url}"),
-            ));
-            Ok(bytes)
-        }
-        Err(e) => Err(format!(
-            "no local upstream pom and the maven2 registry fetch failed ({e}); refusing to \
-             author a minimal pom (it would drop transitive dependencies)"
-        )),
-    }
-}
-
 /// Bounded HTTP GET of a pom from the maven2 registry.
 async fn fetch_pom_bytes(url: &str) -> Result<Vec<u8>, String> {
     fetch_registry_bytes(url, MAX_POM_BYTES as u64).await
@@ -1916,45 +1446,6 @@ pub(super) async fn write_maven_artifact(
     Ok(())
 }
 
-/// True when the committed jar/pom/sidecars are all present and consistent: the
-/// jar's patched files hash to their `afterHash`es and each `.sha1` sidecar
-/// matches its file's bytes (so `checksumPolicy=fail` stays satisfied).
-async fn artifact_in_sync(
-    leaf_dir: &Path,
-    jar_leaf: &str,
-    pom_leaf: &str,
-    files: &HashMap<String, PatchFileInfo>,
-) -> bool {
-    // One guarded read of the jar serves both the member-hash check and its
-    // `.sha1` sidecar compare (the hot path runs on every re-run).
-    let Some(jar) = read_zip_artifact(&leaf_dir.join(jar_leaf)).await else {
-        return false;
-    };
-    if !zip_bytes_match_after_hashes(&jar, files) {
-        return false;
-    }
-    let Ok(recorded) = read_regular_to_string(&leaf_dir.join(format!("{jar_leaf}.sha1"))).await
-    else {
-        return false;
-    };
-    if recorded.trim() != sha1_hex(&jar) {
-        return false;
-    }
-    // The pom + its sidecar must exist and match their bytes too.
-    sidecar_matches(leaf_dir, pom_leaf).await
-}
-
-/// True when `<leaf>.sha1` exists and equals the hex sha1 of `<leaf>`'s bytes.
-async fn sidecar_matches(leaf_dir: &Path, leaf: &str) -> bool {
-    let Ok(bytes) = read_regular_to_bytes(&leaf_dir.join(leaf)).await else {
-        return false;
-    };
-    let Ok(recorded) = read_regular_to_string(&leaf_dir.join(format!("{leaf}.sha1"))).await else {
-        return false;
-    };
-    recorded.trim() == sha1_hex(&bytes)
-}
-
 fn sha1_hex(bytes: &[u8]) -> String {
     hex::encode(Sha1::digest(bytes))
 }
@@ -1974,133 +1465,6 @@ pub(crate) fn sha1_sidecar_matches(jar: &[u8], recorded: &str) -> bool {
     token.eq_ignore_ascii_case(&sha1_hex(jar))
 }
 
-// ── pom.xml editing ──────────────────────────────────────────────────────────────
-
-/// Build the wired `pom.xml` text: insert our `<repository>` into
-/// `<repositories>` (or create the section before `</project>`). The pom is
-/// edited by targeted string insertion so all other bytes — formatting,
-/// comments, key order — are preserved and a later revert restores it
-/// byte-identically. Anchors are chosen with [`find_wireable_anchor`], never a
-/// bare substring match: a `</repositories>` inside an XML comment or inside
-/// `<profiles>` would swallow the block where Maven never reads it, so the
-/// build would silently resolve the UNPATCHED jar while vendor reports
-/// success. `pub(crate)` so vex discovery's tests wire exactly this shape.
-pub(crate) fn build_repo_edit(
-    original: &str,
-    repo_id: &str,
-    uuid_dir_rel: &str,
-) -> Result<String, String> {
-    let block = repository_block(repo_id, uuid_dir_rel);
-    if let Some(at) = find_wireable_anchor(original, "</repositories>") {
-        Ok(insert_block_at(original, at, &block))
-    } else if let Some(at) = find_wireable_anchor(original, "</project>") {
-        let section = format!("  <repositories>\n{block}  </repositories>\n");
-        Ok(insert_block_at(original, at, &section))
-    } else {
-        Err("pom.xml has no </project> to edit".to_string())
-    }
-}
-
-/// The insertion anchor: the first occurrence of `needle` Maven will actually
-/// read — outside every `<!-- -->` comment and outside `<profiles>` (a
-/// profile-scoped `<repositories>` is only consulted when that profile is
-/// activated, so it can never serve the always-on vendored repository).
-/// `None` when every occurrence is masked.
-fn find_wireable_anchor(text: &str, needle: &str) -> Option<usize> {
-    let mut masked = comment_spans(text);
-    masked.extend(profiles_spans(text, &masked));
-    find_outside(text, needle, 0, &masked)
-}
-
-/// Byte spans of `<!-- … -->` comments (an unterminated comment runs to EOF —
-/// the same drop-the-tail discipline as [`strip_xml_comments`]).
-fn comment_spans(text: &str) -> Vec<(usize, usize)> {
-    let mut spans = Vec::new();
-    let mut from = 0;
-    while let Some(rel) = text[from..].find("<!--") {
-        let start = from + rel;
-        match text[start + 4..].find("-->") {
-            Some(rel_end) => {
-                let end = start + 4 + rel_end + 3;
-                spans.push((start, end));
-                from = end;
-            }
-            None => {
-                spans.push((start, text.len()));
-                break;
-            }
-        }
-    }
-    spans
-}
-
-/// Byte spans covered by `<profiles>…</profiles>` elements, with the tags
-/// themselves matched outside `comments`. A self-closing `<profiles/>` spans
-/// nothing; an unclosed element masks through EOF (fail-closed — better to
-/// refuse than to wire a block Maven may never read).
-fn profiles_spans(text: &str, comments: &[(usize, usize)]) -> Vec<(usize, usize)> {
-    const OPEN: &str = "<profiles";
-    const CLOSE: &str = "</profiles>";
-    let mut spans = Vec::new();
-    let mut from = 0;
-    while let Some(open) = find_outside(text, OPEN, from, comments) {
-        // Boundary check: `<profilesX>` is not `<profiles>`.
-        let after = &text[open + OPEN.len()..];
-        let boundary_ok = match after.chars().next() {
-            None => true,
-            Some(c) => c == '>' || c == '/' || c.is_whitespace(),
-        };
-        if !boundary_ok {
-            from = open + OPEN.len();
-            continue;
-        }
-        // A self-closing `<profiles/>` (or `<profiles …/>`) has no interior.
-        if let Some(gt) = text[open..].find('>').map(|r| open + r) {
-            if text[..gt].ends_with('/') {
-                from = gt + 1;
-                continue;
-            }
-        }
-        match find_outside(text, CLOSE, open, comments) {
-            Some(close) => {
-                let end = close + CLOSE.len();
-                spans.push((open, end));
-                from = end;
-            }
-            None => {
-                spans.push((open, text.len()));
-                break;
-            }
-        }
-    }
-    spans
-}
-
-/// First occurrence of `needle` at/after `from` whose start lies outside every
-/// `spans` range; `None` when only masked occurrences remain.
-fn find_outside(text: &str, needle: &str, from: usize, spans: &[(usize, usize)]) -> Option<usize> {
-    let mut at = from;
-    while let Some(rel) = text[at..].find(needle) {
-        let pos = at + rel;
-        if !spans.iter().any(|&(s, e)| pos >= s && pos < e) {
-            return Some(pos);
-        }
-        at = pos + needle.len();
-    }
-    None
-}
-
-/// `insert_before` at a known byte offset: insert `insertion` (already
-/// newline-terminated) at the start of the line containing `at`.
-fn insert_block_at(haystack: &str, at: usize, insertion: &str) -> String {
-    let line_start = haystack[..at].rfind('\n').map(|n| n + 1).unwrap_or(0);
-    let mut out = String::with_capacity(haystack.len() + insertion.len());
-    out.push_str(&haystack[..line_start]);
-    out.push_str(insertion);
-    out.push_str(&haystack[line_start..]);
-    out
-}
-
 /// The `<repository>` element served from the committed maven2 repo. The URL
 /// uses `${project.basedir}` so it resolves relative to the pom on any checkout;
 /// `checksumPolicy=fail` makes Maven hard-fail on a jar/pom that doesn't match
@@ -2122,76 +1486,6 @@ fn repository_block(repo_id: &str, uuid_dir_rel: &str) -> String {
     )
 }
 
-/// True when the pom declares a real (non-commented) `<modules>` element — an
-/// aggregator/multi-module root. Comments are stripped first so a commented-out
-/// `<modules>` never triggers a refusal, and the open tag is boundary-matched
-/// so `<modulesInfo>` is not mistaken for it.
-fn declares_modules(pom_text: &str) -> bool {
-    let stripped = strip_xml_comments(pom_text);
-    real_open_tag(&stripped, "modules")
-}
-
-/// Remove every `<!-- ... -->` span (comments do not nest in XML). Used before
-/// tag detection so commented-out markup is never matched.
-fn strip_xml_comments(text: &str) -> String {
-    let mut out = String::with_capacity(text.len());
-    let mut rest = text;
-    loop {
-        match rest.find("<!--") {
-            Some(start) => {
-                out.push_str(&rest[..start]);
-                match rest[start..].find("-->") {
-                    Some(end) => rest = &rest[start + end + 3..],
-                    None => return out, // unterminated comment: drop the tail
-                }
-            }
-            None => {
-                out.push_str(rest);
-                return out;
-            }
-        }
-    }
-}
-
-/// True when `text` contains a real opening tag for `element` — `<element>`,
-/// `<element ...>`, or `<element/>` — where the char after the name is a tag
-/// boundary (`>`, `/`, or whitespace). Prefix matches (`<modulesInfo>`) do not
-/// count. Mirrors the maven crawler's `opening_tag` boundary discipline.
-fn real_open_tag(text: &str, element: &str) -> bool {
-    let needle = format!("<{element}");
-    let mut from = 0;
-    while let Some(rel) = text[from..].find(&needle) {
-        let pos = from + rel;
-        let after = &text[pos + needle.len()..];
-        match after.chars().next() {
-            None => return true, // name runs to end of input
-            Some(c) if c == '>' || c == '/' || c.is_whitespace() => return true,
-            _ => from = pos + needle.len(),
-        }
-    }
-    false
-}
-
-/// The always-on `vendor_maven_local_cache_shadow` advisory carrying the purge
-/// one-liner.
-fn local_cache_shadow_warning(
-    group_id: &str,
-    artifact_id: &str,
-    version: &str,
-    group_path: &str,
-) -> VendorWarning {
-    VendorWarning::new(
-        "vendor_maven_local_cache_shadow",
-        format!(
-            "Maven resolves the local repository (~/.m2) BEFORE any configured <repository>, so a \
-             warm ~/.m2 copy of {group_id}:{artifact_id}:{version} silently shadows the vendored \
-             patched artifact. Purge it with: \
-             mvn dependency:purge-local-repository -DmanualInclude={group_id}:{artifact_id} \
-             (or delete ~/.m2/repository/{group_path}/{artifact_id}/{version})"
-        ),
-    )
-}
-
 /// Revert our `<repository>` wiring from `pom.xml`. `Ok(true)` = reverted (or
 /// would be on dry run) / already gone; `Ok(false)` = drifted (the live pom no
 /// longer carries our repository block), left alone; `Err` = a real I/O failure.
@@ -2201,7 +1495,7 @@ fn local_cache_shadow_warning(
 /// wrote (`w.new`) — nothing has changed since vendoring. Otherwise — a sibling
 /// patch added another `<repository>` into the same `<repositories>`, or the
 /// user hand-edited the pom AFTER vendoring — we surgically excise ONLY the
-/// exact `<repository>` block we authored (`build_repo_edit` renders it
+/// exact `<repository>` block we authored ([`repository_block`] renders it
 /// deterministically, so we reproduce it verbatim from the repo id + uuid dir)
 /// and leave every other byte (sibling wiring, user edits) intact. If we
 /// created the `<repositories>` section and excising our block leaves it empty,
@@ -2270,9 +1564,9 @@ async fn revert_repo_record(
 }
 
 /// After excising our `<repository>`, drop a `<repositories>` section left with
-/// no children (the section we created for the first vendored package). Matches
-/// `build_repo_edit`'s `  <repositories>\n…  </repositories>\n` rendering so a
-/// section it created is removed byte-for-byte; a section that still holds a
+/// no children (the section the pre-v5 backend created for the first vendored
+/// package, rendered as `  <repositories>\n` + blocks + `  </repositories>\n`
+/// just before `</project>`), byte for byte; a section that still holds a
 /// sibling `<repository>` is untouched (its inner bytes are non-whitespace).
 fn strip_empty_repositories(pom: &str) -> String {
     let open = "  <repositories>\n";
@@ -2301,9 +1595,13 @@ mod tests {
     use std::io::{Read as _, Write as _};
     use std::path::PathBuf;
 
+    use std::collections::HashMap;
+
     use super::*;
     use crate::hash::git_sha256::compute_git_sha256_from_bytes;
-    use crate::vendor::state::VENDOR_MARKER_FILE;
+    use crate::manifest::schema::PatchFileInfo;
+    use crate::patch::apply::ApplyResult;
+    use crate::vendor::jvm::layout::is_path_safe;
 
     const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
     const PURL: &str = "pkg:maven/org.apache.commons/commons-text@1.10.0";
@@ -2597,213 +1895,6 @@ mod tests {
         Some(out)
     }
 
-    /// In-memory repack equivalence: keeping the jar's members in memory must rebuild the
-    /// EXACT bytes the extract-to-disk rebuild produced — the artifact's sha1
-    /// sidecar and every downstream pin ride on them. Driven twice over one
-    /// fixture, once with the in-memory repack forced off.
-
-    /// A jar whose entry escapes the stage must be refused the same way
-    /// whichever staging path ran — the traversal guard is the one thing both
-    /// readers have to agree on before anything is written.
-
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn happy_path_wires_repo_jar_pom_sidecars() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-
-        let (result, entry, warnings) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{:?}", result.error);
-
-        // Artifact: rebuilt jar with the patched NOTICE.txt at the maven2 leaf.
-        let jar = tokio::fs::read(root.join(jar_rel())).await.unwrap();
-        assert_eq!(read_jar_entry(&jar, JAR_FILE).as_deref(), Some(PATCHED));
-        assert!(read_jar_entry(&jar, "META-INF/MANIFEST.MF").is_some());
-
-        // Real upstream pom copied verbatim (carries the transitive dep).
-        let pom = tokio::fs::read(root.join(format!("{}/commons-text-1.10.0.pom", leaf_rel())))
-            .await
-            .unwrap();
-        assert_eq!(pom, UPSTREAM_POM);
-        assert!(
-            String::from_utf8_lossy(&pom).contains("commons-lang3"),
-            "vendored pom keeps the transitive declaration"
-        );
-
-        // sha1 sidecars for both, matching the bytes.
-        let jar_sha1 = tokio::fs::read_to_string(root.join(format!("{}.sha1", jar_rel())))
-            .await
-            .unwrap();
-        assert_eq!(jar_sha1.trim(), sha1_hex(&jar));
-        let pom_sha1 = tokio::fs::read_to_string(
-            root.join(format!("{}/commons-text-1.10.0.pom.sha1", leaf_rel())),
-        )
-        .await
-        .unwrap();
-        assert_eq!(pom_sha1.trim(), sha1_hex(UPSTREAM_POM));
-
-        // Marker present.
-        assert!(root
-            .join(format!(".socket/vendor/maven/{UUID}/{VENDOR_MARKER_FILE}"))
-            .exists());
-
-        // pom.xml wired with our <repository> (id + file:// url + checksumPolicy).
-        let pom_xml = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        assert!(pom_xml.contains(&format!("<id>socket-patch-vendor-{UUID}</id>")));
-        assert!(pom_xml.contains(&format!(
-            "<url>file://${{project.basedir}}/.socket/vendor/maven/{UUID}</url>"
-        )));
-        assert!(pom_xml.contains("<checksumPolicy>fail</checksumPolicy>"));
-        assert!(pom_xml.contains("<repositories>"));
-
-        // The always-on shadow advisory fired.
-        assert!(
-            warnings
-                .iter()
-                .any(|w| w.code == "vendor_maven_local_cache_shadow"),
-            "shadow warning must always fire: {warnings:?}"
-        );
-        assert!(
-            warnings
-                .iter()
-                .any(|w| w.code == "vendor_maven_local_cache_shadow"
-                    && w.detail.contains("purge-local-repository")),
-            "shadow warning carries the purge one-liner"
-        );
-
-        // Ledger entry shape.
-        let entry = entry.expect("success carries a ledger entry");
-        assert_eq!(entry.ecosystem, "maven");
-        assert_eq!(entry.base_purl, PURL);
-        assert_eq!(entry.artifact.path, jar_rel());
-        assert_eq!(entry.wiring.len(), 1);
-        assert_eq!(entry.wiring[0].kind, REPO_WIRING_KIND);
-        assert_eq!(entry.wiring[0].action, WiringAction::Added);
-        assert_eq!(
-            entry.wiring[0].key.as_deref(),
-            Some(format!("socket-patch-vendor-{UUID}").as_str())
-        );
-    }
-
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn rerun_is_idempotent_no_rerecord() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-
-        let (r1, e1, _) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success);
-        assert!(e1.is_some());
-        let pom_xml1 = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
-        let jar1 = tokio::fs::read(root.join(jar_rel())).await.unwrap();
-
-        let (r2, e2, w2) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r2.success);
-        assert!(e2.is_none(), "in-sync rerun must not re-record the ledger");
-        assert_eq!(
-            tokio::fs::read(root.join(PROJECT_POM)).await.unwrap(),
-            pom_xml1
-        );
-        assert_eq!(
-            tokio::fs::read(root.join(jar_rel())).await.unwrap(),
-            jar1,
-            "re-zip is deterministic"
-        );
-        assert!(
-            w2.iter()
-                .any(|w| w.code == "vendor_maven_local_cache_shadow"),
-            "shadow warning fires on the hot path too"
-        );
-    }
-
-    /// B61: a commented-out vendored `<repository>` is not wiring Maven
-    /// reads, so a re-run must rewire instead of taking the in-sync hot path
-    /// on a raw substring match of the repository id.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn commented_out_repository_is_not_wired() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let (r1, e1, _) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success && e1.is_some());
-
-        let block = repository_block(
-            &format!("{VENDOR_REPO_ID_PREFIX}{UUID}"),
-            &format!(".socket/vendor/maven/{UUID}"),
-        );
-        let pom = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        assert!(pom.contains(&block), "first run wires our block: {pom}");
-        tokio::fs::write(
-            root.join(PROJECT_POM),
-            pom.replacen(&block, &format!("<!--\n{block}-->\n"), 1),
-        )
-        .await
-        .unwrap();
-
-        let (r2, e2, _) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r2.success, "{:?}", r2.error);
-        assert!(
-            e2.is_some(),
-            "a commented-out repository must not take the in-sync hot path"
-        );
-        let rewired = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        assert!(
-            strip_xml_comments(&rewired)
-                .contains(&format!("<id>{VENDOR_REPO_ID_PREFIX}{UUID}</id>")),
-            "the re-run wires a live repository: {rewired}"
-        );
-    }
-
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wired_missing_artifact_rebuilds_only() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-
-        let (r1, e1, _) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success);
-        assert!(e1.is_some());
-        let pom_xml1 = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
-        let jar1 = tokio::fs::read(root.join(jar_rel())).await.unwrap();
-
-        // Simulate the fresh-clone hole: the committed artifact is gone.
-        remove_tree(&root.join(format!(".socket/vendor/maven/{UUID}")))
-            .await
-            .unwrap();
-
-        let (r2, e2, w2) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r2.success, "{:?}", r2.error);
-        // A refreshed fingerprint with NO wiring of its own: re-recording
-        // would clobber the pre-vendor pom.xml (the caller carries it).
-        let e2 = e2.expect("the rebuild refreshes the ledger fingerprint");
-        assert!(
-            e2.wiring.is_empty(),
-            "no re-recorded wiring: {:?}",
-            e2.wiring
-        );
-        assert!(
-            w2.iter().any(|w| w.code == "vendor_artifact_rebuilt"),
-            "rebuild is surfaced: {w2:?}"
-        );
-        assert_eq!(
-            tokio::fs::read(root.join(jar_rel())).await.unwrap(),
-            jar1,
-            "rebuilt jar is byte-identical"
-        );
-        assert_eq!(
-            tokio::fs::read(root.join(PROJECT_POM)).await.unwrap(),
-            pom_xml1,
-            "pom.xml untouched by the rebuild"
-        );
-    }
-
     #[tokio::test]
     #[serial_test::serial]
     async fn missing_reactor_module_is_refused_without_writes() {
@@ -2824,10 +1915,11 @@ mod tests {
         assert!(!root.join(".socket").exists(), "refusal writes nothing");
     }
 
+    /// #716: a commented-out `<modules>` is not a reactor's; the pom is
+    /// planned as a single module.
     #[tokio::test]
     #[serial_test::serial]
     async fn commented_modules_do_not_refuse() {
-        // A commented-out <modules> must NOT trigger the aggregator refusal.
         let commented = "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n\
              \x20 <modelVersion>4.0.0</modelVersion>\n\
              \x20 <groupId>com.example</groupId>\n\
@@ -2837,13 +1929,17 @@ mod tests {
              </project>\n";
         let (dir, blobs, installed, record) = fixture(Some(commented), true, true).await;
         let root = dir.path();
-        let (result, _e, _w) =
+        let (result, entry, _w) =
             unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
         assert!(
             result.success,
             "commented <modules> must not refuse: {:?}",
             result.error
         );
+        assert_eq!(entry.unwrap().ecosystem, layout::LEDGER_ECOSYSTEM);
+        let pom = std::fs::read_to_string(root.join(PROJECT_POM)).unwrap();
+        assert!(pom.contains("<module>old</module></modules> -->"), "{pom}");
+        assert!(pom.contains("1.10.0-socket."), "{pom}");
     }
 
     #[tokio::test]
@@ -2862,32 +1958,6 @@ mod tests {
         assert!(root.join(".socket/vendor/gradle-index.tsv").is_file());
     }
 
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn refuses_pom_unavailable() {
-        // pom.xml present, local jar present, but NO upstream pom (and no
-        // service) → refuse rather than author a minimal pom.
-        let (dir, blobs, installed, record) =
-            fixture(Some(project_pom()), true, /*with_local_pom=*/ false).await;
-        let root = dir.path();
-        let (code, detail) =
-            unwrap_refused(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert_eq!(code, "vendor_maven_pom_unavailable");
-        assert!(
-            detail.contains("minimal pom"),
-            "refusal explains why: {detail}"
-        );
-        assert!(
-            !root.join(format!(".socket/vendor/maven/{UUID}")).exists(),
-            "a partial artifact must be cleaned up on the pom refusal"
-        );
-        // pom.xml never wired.
-        let pom_xml = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        assert!(!pom_xml.contains("socket-patch-vendor"));
-    }
-
     #[tokio::test]
     #[serial_test::serial]
     async fn refuses_unsafe_coordinates() {
@@ -2937,22 +2007,19 @@ mod tests {
         assert!(
             warnings
                 .iter()
-                .any(|w| w.code == "vendor_maven_local_cache_shadow"),
-            "dry run predicts the shadow advisory"
+                .any(|w| w.detail.starts_with("reason: maven_mirror_of_all: ")),
+            "dry run predicts the wrapper-less warnings: {warnings:?}"
         );
     }
 
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_restores_pom_byte_identical() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
         let pom_before = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
 
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
         assert_ne!(
             tokio::fs::read(root.join(PROJECT_POM)).await.unwrap(),
             pom_before,
@@ -2983,13 +2050,10 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_drift_leaves_pom_alone() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
 
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
 
         // Third-party drift: the user regenerated pom.xml without our repo.
         tokio::fs::write(root.join(PROJECT_POM), project_pom())
@@ -3027,13 +2091,10 @@ mod tests {
         // section (simulated by inserting before </repositories>). Reverting
         // us must excise ONLY our block and keep the sibling's wiring intact —
         // a whole-file restore would wipe it.
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
 
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
 
         // A sibling patch's <repository> lands in the section we created.
         let wired = tokio::fs::read_to_string(root.join(PROJECT_POM))
@@ -3081,13 +2142,10 @@ mod tests {
         // The user edits the pom AFTER vendoring (adds a <properties> block).
         // Revert must remove our <repository> (and the section we created) yet
         // keep the user's edit — the whole-file restore would have discarded it.
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
 
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
 
         let wired = tokio::fs::read_to_string(root.join(PROJECT_POM))
             .await
@@ -3131,13 +2189,10 @@ mod tests {
         // The user regenerated the pom, dropping our block but keeping a
         // hand-written <repositories>. Our exact block is absent → drift, and
         // we must NOT touch their section.
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
 
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
 
         let regenerated = "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n\
              \x20 <modelVersion>4.0.0</modelVersion>\n\
@@ -3193,47 +2248,6 @@ mod tests {
         );
     }
 
-    #[test]
-    #[serial_test::serial]
-    fn declares_modules_boundary_and_comment_discipline() {
-        assert!(declares_modules(
-            "<project><modules><module>a</module></modules></project>"
-        ));
-        assert!(declares_modules(
-            "<project>\n<modules>\n</modules>\n</project>"
-        ));
-        // Prefix decoy: <modulesInfo> is not <modules>.
-        assert!(!declares_modules(
-            "<project><modulesInfo>x</modulesInfo></project>"
-        ));
-        // Commented-out modules must not count.
-        assert!(!declares_modules(
-            "<project><!-- <modules><module>a</module></modules> --></project>"
-        ));
-    }
-
-    #[test]
-    #[serial_test::serial]
-    fn repo_edit_extends_existing_repositories() {
-        let orig = "<project>\n  <repositories>\n    <repository><id>corp</id></repository>\n  </repositories>\n</project>\n";
-        let out = build_repo_edit(orig, "socket-patch-vendor-x", ".socket/vendor/maven/x").unwrap();
-        // Original corp repo survives, ours added before </repositories>.
-        assert!(out.contains("<id>corp</id>"));
-        assert!(out.contains("<id>socket-patch-vendor-x</id>"));
-        assert_eq!(out.matches("</repositories>").count(), 1);
-    }
-
-    #[test]
-    #[serial_test::serial]
-    fn repo_edit_creates_repositories_section() {
-        let orig = "<project>\n  <artifactId>app</artifactId>\n</project>\n";
-        let out = build_repo_edit(orig, "socket-patch-vendor-x", ".socket/vendor/maven/x").unwrap();
-        assert!(out.contains("<repositories>"));
-        assert!(out.contains("</repositories>"));
-        assert!(out.contains("<id>socket-patch-vendor-x</id>"));
-        assert!(out.trim_end().ends_with("</project>"));
-    }
-
     #[test]
     #[serial_test::serial]
     fn group_id_path_and_safety() {
@@ -3251,127 +2265,12 @@ mod tests {
         assert!(!is_safe_group_id("a:b"));
     }
 
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wires_outside_commented_repositories() {
-        // A commented-out <repositories> section must not capture the insert:
-        // a block landing inside the comment is invisible to Maven, so the
-        // build would silently resolve the UNPATCHED jar while vendor reports
-        // success.
-        let commented = "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n\
-             \x20 <modelVersion>4.0.0</modelVersion>\n\
-             \x20 <groupId>com.example</groupId>\n\
-             \x20 <artifactId>app</artifactId>\n\
-             \x20 <version>1.0.0</version>\n\
-             \x20 <!--\n\
-             \x20 <repositories>\n\
-             \x20   <repository><id>old-corp</id><url>https://old/repo</url></repository>\n\
-             \x20 </repositories>\n\
-             \x20 -->\n\
-             </project>\n";
-        let (dir, blobs, installed, record) = fixture(Some(commented), true, true).await;
-        let root = dir.path();
-        let (result, _e, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{:?}", result.error);
-        let wired = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        assert!(
-            strip_xml_comments(&wired).contains(&format!("<id>socket-patch-vendor-{UUID}</id>")),
-            "the vendored <repository> must be outside comments (Maven-visible): {wired}"
-        );
-    }
-
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wires_project_root_not_profile_repositories() {
-        // A <repositories> inside <profiles> is only consulted when that
-        // profile is activated; anchoring our block there leaves the default
-        // build silently resolving the UNPATCHED jar.
-        let profiled = "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n\
-             \x20 <modelVersion>4.0.0</modelVersion>\n\
-             \x20 <groupId>com.example</groupId>\n\
-             \x20 <artifactId>app</artifactId>\n\
-             \x20 <version>1.0.0</version>\n\
-             \x20 <profiles>\n\
-             \x20   <profile>\n\
-             \x20     <id>internal</id>\n\
-             \x20     <repositories>\n\
-             \x20       <repository><id>corp</id><url>https://corp/repo</url></repository>\n\
-             \x20     </repositories>\n\
-             \x20   </profile>\n\
-             \x20 </profiles>\n\
-             </project>\n";
-        let (dir, blobs, installed, record) = fixture(Some(profiled), true, true).await;
-        let root = dir.path();
-        let (result, _e, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{:?}", result.error);
-        let wired = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        let id = format!("<id>socket-patch-vendor-{UUID}</id>");
-        assert!(wired.contains(&id), "wired: {wired}");
-        let p_open = wired.find("<profiles>").unwrap();
-        let p_close = wired.find("</profiles>").unwrap();
-        assert!(
-            !wired[p_open..p_close].contains(&id),
-            "the vendored <repository> must not land inside <profiles>: {wired}"
-        );
-    }
-
-    #[test]
-    #[serial_test::serial]
-    fn repo_edit_skips_commented_and_profile_anchors() {
-        // Only a commented </repositories> → a NEW real section is created.
-        let commented = "<project>\n<!--\n  <repositories>\n  </repositories>\n-->\n</project>\n";
-        let out =
-            build_repo_edit(commented, "socket-patch-vendor-x", ".socket/vendor/maven/x").unwrap();
-        assert!(
-            strip_xml_comments(&out).contains("<id>socket-patch-vendor-x</id>"),
-            "block must be Maven-visible: {out}"
-        );
-        // Only a profile-scoped </repositories> → likewise anchored at </project>.
-        let profiled = "<project>\n  <profiles>\n    <profile>\n      <repositories>\n      \
-                        </repositories>\n    </profile>\n  </profiles>\n</project>\n";
-        let out =
-            build_repo_edit(profiled, "socket-patch-vendor-x", ".socket/vendor/maven/x").unwrap();
-        let p_close = out.find("</profiles>").unwrap();
-        let id_at = out.find("<id>socket-patch-vendor-x</id>").unwrap();
-        assert!(id_at > p_close, "block must land after </profiles>: {out}");
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wire_preserves_pom_xml_mode() {
-        use std::os::unix::fs::PermissionsExt as _;
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let pom_path = root.join(PROJECT_POM);
-        tokio::fs::set_permissions(&pom_path, std::fs::Permissions::from_mode(0o600))
-            .await
-            .unwrap();
-
-        let (result, _e, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{:?}", result.error);
-        let mode = tokio::fs::metadata(&pom_path)
-            .await
-            .unwrap()
-            .permissions()
-            .mode()
-            & 0o7777;
-        assert_eq!(mode, 0o600, "wiring must not reset the user's pom.xml mode");
-    }
-
     #[cfg(unix)]
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_preserves_pom_xml_mode() {
         use std::os::unix::fs::PermissionsExt as _;
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
         let pom_path = root.join(PROJECT_POM);
 
@@ -3380,10 +2279,7 @@ mod tests {
         }
 
         // Byte-identical fast path (whole-file restore).
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
         tokio::fs::set_permissions(&pom_path, std::fs::Permissions::from_mode(0o600))
             .await
             .unwrap();
@@ -3396,10 +2292,7 @@ mod tests {
         );
 
         // Re-vendor, drift with a user edit, revert → the excise path writes too.
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
         let wired = tokio::fs::read_to_string(&pom_path).await.unwrap();
         let edited = wired.replacen(
             "</project>",
@@ -3419,28 +2312,6 @@ mod tests {
         );
     }
 
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wired_rebuild_reports_vendored_jar_path() {
-        // The wired-but-missing-artifact rebuild leg must report the vendored
-        // jar path, not the (deleted) temp stage the rebuild ran in.
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let (r1, _e, _w) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success);
-        remove_tree(&root.join(format!(".socket/vendor/maven/{UUID}")))
-            .await
-            .unwrap();
-        let (r2, _e2, _w2) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r2.success, "{:?}", r2.error);
-        assert_eq!(
-            r2.package_path,
-            root.join(jar_rel()).display().to_string(),
-            "rebuild leg must report the vendored jar, not the temp stage"
-        );
-    }
-
     #[cfg(unix)]
     fn mkfifo(path: &Path) {
         use std::os::unix::ffi::OsStrExt;
@@ -3475,96 +2346,27 @@ mod tests {
         }
     }
 
-    /// A FIFO planted as the committed vendored pom (the tamper-able tree)
-    /// must read as out-of-sync — triggering the artifact rebuild that
-    /// atomically replaces it — instead of wedging the in-sync hot path
-    /// forever in an `open(2)` waiting for a writer. The jar half of this
-    /// probe (`read_zip_artifact` + `zip_bytes_match_after_hashes`) is
-    /// already guarded in common.rs; this pins the `sidecar_matches` half.
+    /// A FIFO planted as the project `pom.xml` reads as no build file (the
+    /// planner reads regular files only) instead of wedging every vendor
+    /// run forever.
     #[cfg(unix)]
     #[tokio::test]
     #[serial_test::serial]
-    async fn fifo_vendored_pom_fails_fast_and_rebuilds_on_hot_path() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+    async fn fifo_project_pom_fails_fast_in_vendor() {
+        let (dir, blobs, installed, record) = fixture(None, true, true).await;
         let root = dir.path();
-        let (r1, _e, _w) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success);
-        let vendored_pom = root.join(format!("{}/commons-text-1.10.0.pom", leaf_rel()));
-        tokio::fs::remove_file(&vendored_pom).await.unwrap();
-        mkfifo(&vendored_pom);
+        let pom_path = root.join(PROJECT_POM);
+        mkfifo(&pom_path);
 
         let outcome = expect_fast(
             run_vendor(root, &blobs, &installed, &record, false),
-            &vendored_pom,
-            "the in-sync probe must fail fast on a FIFO vendored pom, not wedge",
-        )
-        .await;
-        let (r2, e2, w2) = unwrap_done(outcome);
-        assert!(r2.success, "{:?}", r2.error);
-        assert!(
-            e2.is_some_and(|e| e.wiring.is_empty()),
-            "artifact-only rebuild refreshes the fingerprint, never the wiring"
-        );
-        assert!(
-            w2.iter().any(|w| w.code == "vendor_artifact_rebuilt"),
-            "FIFO pom must read as stale and trigger the rebuild: {w2:?}"
-        );
-        assert_eq!(
-            tokio::fs::read(&vendored_pom).await.unwrap(),
-            UPSTREAM_POM,
-            "the rebuild must atomically replace the FIFO with the real pom"
-        );
-    }
-
-    /// A FIFO planted as the project `pom.xml` must surface the fail-closed
-    /// unreadable refusal instead of wedging every vendor run forever.
-    #[cfg(unix)]
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn fifo_project_pom_fails_fast_in_vendor() {
-        let (dir, blobs, installed, record) = fixture(None, true, true).await;
-        let root = dir.path();
-        let pom_path = root.join(PROJECT_POM);
-        mkfifo(&pom_path);
-
-        let outcome = expect_fast(
-            run_vendor(root, &blobs, &installed, &record, false),
-            &pom_path,
-            "vendor must fail fast on a FIFO pom.xml, not wedge",
-        )
-        .await;
-        let (code, _d) = unwrap_refused(outcome);
-        assert_eq!(code, "vendor_maven_pom_unreadable");
-    }
-
-    /// A FIFO planted as the cached `~/.m2` pom must map to the
-    /// pom-unavailable refusal fast instead of wedging the pom copy forever.
-    #[cfg(unix)]
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn fifo_local_pom_fails_fast_in_acquire_upstream_pom() {
-        let (dir, blobs, installed, record) =
-            fixture(Some(project_pom()), true, /*with_local_pom=*/ false).await;
-        let root = dir.path();
-        let fifo_pom = installed.join("commons-text-1.10.0.pom");
-        mkfifo(&fifo_pom);
-
-        let outcome = expect_fast(
-            run_vendor(root, &blobs, &installed, &record, false),
-            &fifo_pom,
-            "the pom copy must fail fast on a FIFO local pom, not wedge",
+            &pom_path,
+            "vendor must fail fast on a FIFO pom.xml, not wedge",
         )
         .await;
         let (code, detail) = unwrap_refused(outcome);
-        assert_eq!(code, "vendor_maven_pom_unavailable");
-        assert!(
-            detail.contains("unreadable local pom"),
-            "refusal names the unreadable pom: {detail}"
-        );
-        assert!(
-            !root.join(format!(".socket/vendor/maven/{UUID}")).exists(),
-            "no partial artifact may survive the refusal"
-        );
+        assert_eq!(code, "vendor_jvm_shape_unsupported");
+        assert!(detail.starts_with("reason: no_build_file: "), "{detail}");
     }
 
     /// Maven Central blocks/rate-limits user agents containing "socket" —
@@ -3616,12 +2418,9 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn fifo_project_pom_fails_fast_in_revert() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
 
         let pom_path = root.join(PROJECT_POM);
         tokio::fs::remove_file(&pom_path).await.unwrap();
@@ -3752,273 +2551,20 @@ mod tests {
         assert!(!root.join(".socket").exists(), "refusal writes nothing");
     }
 
-    /// No pom.xml AND no gradle marker → the plain missing-pom refusal (the
-    /// gradle sibling is tested above; this pins the non-gradle arm and
-    /// `layout::has_build(.., Gradle)` returning false through all four probes).
+    /// No pom.xml and no Gradle, sbt or scala-cli build: the planner's
+    /// `no_build_file` refusal, with nothing written and no service call
+    /// planned.
     #[tokio::test]
     #[serial_test::serial]
-    async fn refuses_pom_project_missing_without_gradle_marker() {
+    async fn refuses_a_root_with_no_build_file() {
         let (dir, blobs, installed, record) = fixture(None, true, true).await;
         let root = dir.path();
         let (code, detail) =
             unwrap_refused(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert_eq!(code, "vendor_maven_pom_project_missing");
-        assert!(
-            detail.contains("pom.xml"),
-            "refusal names the missing project file: {detail}"
-        );
+        assert_eq!(code, "vendor_jvm_shape_unsupported");
+        assert!(detail.starts_with("reason: no_build_file: "), "{detail}");
         assert!(!root.join(".socket").exists(), "refusal writes nothing");
-    }
-
-    /// Wired hot path, stale artifact, and the cached ~/.m2 jar is ALSO gone
-    /// (fresh clone with an empty local cache): the rebuild's refusal bubbles
-    /// out while pom.xml keeps our (now-dangling) <repository> — documenting
-    /// the wired-but-refused state.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wired_missing_jar_bubbles_refusal_keeping_wiring() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let (r1, _e, _w) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success);
-        let wired = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
-
-        remove_tree(&root.join(format!(".socket/vendor/maven/{UUID}")))
-            .await
-            .unwrap();
-        tokio::fs::remove_file(installed.join("commons-text-1.10.0.jar"))
-            .await
-            .unwrap();
-
-        let (code, _d) = unwrap_refused(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert_eq!(code, "vendor_prebuilt_required");
-        assert_eq!(
-            tokio::fs::read(root.join(PROJECT_POM)).await.unwrap(),
-            wired,
-            "the refusal must not touch the wired pom.xml"
-        );
-        assert!(
-            !root.join(format!(".socket/vendor/maven/{UUID}")).exists(),
-            "nothing may be recreated on the refusal"
-        );
-    }
-
-    /// Wired hot path, stale artifact, and the rebuild fails non-fatally (the
-    /// patch blob is gone): the un-successful result is reported with no
-    /// ledger re-record, pom.xml untouched, and no partial uuid dir.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wired_rebuild_failure_reports_unsuccessful_result() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let (r1, _e, _w) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success);
-        let wired = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
-
-        remove_tree(&root.join(format!(".socket/vendor/maven/{UUID}")))
-            .await
-            .unwrap();
-        tokio::fs::remove_file(blobs.join(compute_git_sha256_from_bytes(PATCHED)))
-            .await
-            .unwrap();
-
-        let (r2, e2, _w2) = crate::vendor::test_support::expect_failed(
-            run_vendor(root, &blobs, &installed, &record, false).await,
-        );
-        assert!(!r2.success, "a blob-less rebuild cannot succeed");
-        assert!(r2.error.is_some(), "the failure carries a detail");
-        assert!(e2.is_none(), "a failed rebuild must not re-record");
-        assert_eq!(
-            tokio::fs::read(root.join(PROJECT_POM)).await.unwrap(),
-            wired,
-            "pom.xml untouched by the failed rebuild"
-        );
-        assert!(
-            !root.join(format!(".socket/vendor/maven/{UUID}")).exists(),
-            "no partial uuid dir may be left behind"
-        );
-    }
-
-    /// Wired hot path + stale artifact + --dry-run: falls through to the
-    /// verify-only preview — nothing is rebuilt or written.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wired_stale_artifact_dry_run_previews_without_writing() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let (r1, _e, _w) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success);
-        remove_tree(&root.join(format!(".socket/vendor/maven/{UUID}")))
-            .await
-            .unwrap();
-        let wired = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
-
-        let (r2, e2, w2) = unwrap_done(run_vendor(root, &blobs, &installed, &record, true).await);
-        assert!(r2.success, "{:?}", r2.error);
-        assert!(e2.is_none(), "dry run records nothing");
-        assert!(
-            !root.join(format!(".socket/vendor/maven/{UUID}")).exists(),
-            "dry run must not rebuild the artifact"
-        );
-        assert_eq!(
-            tokio::fs::read(root.join(PROJECT_POM)).await.unwrap(),
-            wired,
-            "dry run must not touch pom.xml"
-        );
-        assert!(
-            !w2.iter().any(|w| w.code == "vendor_artifact_rebuilt"),
-            "the preview must not claim a rebuild happened: {w2:?}"
-        );
-    }
-
-    /// build_repo_edit failure AFTER the artifact was materialised (a pom.xml
-    /// with no </project>): success flips false, the detail is carried, and
-    /// the uuid dir is removed so no orphan artifact survives.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn unwireable_pom_fails_after_materialise_and_cleans_up() {
-        let broken = "<project>\n  <artifactId>app</artifactId>\n";
-        let (dir, blobs, installed, record) = fixture(Some(broken), true, true).await;
-        let root = dir.path();
-
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(!result.success, "an unwireable pom cannot succeed");
-        assert!(
-            result
-                .error
-                .as_deref()
-                .is_some_and(|e| e.contains("no </project>")),
-            "failure names the missing anchor: {:?}",
-            result.error
-        );
-        assert!(entry.is_none());
-        assert!(
-            !root.join(format!(".socket/vendor/maven/{UUID}")).exists(),
-            "the materialised artifact must be cleaned up when wiring fails"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(PROJECT_POM))
-                .await
-                .unwrap(),
-            broken,
-            "the unwireable pom.xml is left as-is"
-        );
-    }
-
-    /// Unit legs of the wiring-failure class: no </project> at all, and an
-    /// unterminated comment masking BOTH anchors to EOF (fail-closed).
-    #[test]
-    #[serial_test::serial]
-    fn repo_edit_errors_without_unmasked_project_close() {
-        let err = build_repo_edit(
-            "<project><artifactId>x</artifactId>",
-            "socket-patch-vendor-x",
-            ".socket/vendor/maven/x",
-        )
-        .unwrap_err();
-        assert!(err.contains("no </project>"), "{err}");
-
-        // The unterminated comment swallows </repositories> AND </project>.
-        let err = build_repo_edit(
-            "<project><!-- </repositories> </project>",
-            "socket-patch-vendor-x",
-            ".socket/vendor/maven/x",
-        )
-        .unwrap_err();
-        assert!(err.contains("no </project>"), "{err}");
-
-        // The span itself: an unterminated comment runs to EOF.
-        assert_eq!(comment_spans("<a><!-- unterminated"), vec![(3, 20)]);
-    }
-
-    /// A pom.xml write failure (read-only project root) after the artifact was
-    /// materialised: the uuid dir is removed and the error names the pom.xml.
-    #[cfg(unix)]
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn pom_write_failure_cleans_up_artifact() {
-        use std::os::unix::fs::PermissionsExt as _;
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        // Pre-create the full leaf chain so materialisation (inside .socket)
-        // succeeds under a read-only root — only the pom.xml write can fail.
-        tokio::fs::create_dir_all(root.join(leaf_rel()))
-            .await
-            .unwrap();
-
-        tokio::fs::set_permissions(root, std::fs::Permissions::from_mode(0o555))
-            .await
-            .unwrap();
-        // Skip when the environment ignores modes (running as root).
-        if std::fs::write(root.join(".probe"), b"x").is_ok() {
-            let _ = std::fs::remove_file(root.join(".probe"));
-            tokio::fs::set_permissions(root, std::fs::Permissions::from_mode(0o755))
-                .await
-                .unwrap();
-            return;
-        }
-        let outcome = run_vendor(root, &blobs, &installed, &record, false).await;
-        tokio::fs::set_permissions(root, std::fs::Permissions::from_mode(0o755))
-            .await
-            .unwrap();
-
-        let (result, entry, _w) = unwrap_done(outcome);
-        assert!(!result.success, "a failed pom.xml write cannot succeed");
-        assert!(
-            result
-                .error
-                .as_deref()
-                .is_some_and(|e| e.contains("failed to write") && e.contains("pom.xml")),
-            "failure names the pom.xml write: {:?}",
-            result.error
-        );
-        assert!(entry.is_none());
-        assert!(
-            !root.join(format!(".socket/vendor/maven/{UUID}")).exists(),
-            "the materialised artifact must be cleaned up when the pom.xml write fails"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(PROJECT_POM))
-                .await
-                .unwrap(),
-            project_pom(),
-            "pom.xml unchanged"
-        );
-    }
-
-    /// A marker write failure must NOT fail an otherwise-wired vendor —
-    /// state.json is the ledger of record; the marker is advisory only.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn marker_write_failure_warns_but_succeeds() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        // A NON-EMPTY directory planted at the marker path makes the atomic
-        // rename fail deterministically on every platform.
-        let marker_path = root.join(format!(".socket/vendor/maven/{UUID}/{VENDOR_MARKER_FILE}"));
-        tokio::fs::create_dir_all(&marker_path).await.unwrap();
-        tokio::fs::write(marker_path.join("occupied"), b"x")
-            .await
-            .unwrap();
-
-        let (result, entry, warnings) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{:?}", result.error);
-        assert!(entry.is_some(), "the vendor is recorded despite the marker");
-        assert!(
-            warnings
-                .iter()
-                .any(|w| w.code == "vendor_marker_write_failed"),
-            "the marker failure is surfaced as a warning: {warnings:?}"
-        );
-        let pom_xml = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        assert!(
-            pom_xml.contains(&format!("socket-patch-vendor-{UUID}")),
-            "pom.xml is wired despite the marker failure"
-        );
+        assert!(service_preflight(PURL, root, &record).await.is_none());
     }
 
     /// Revert fail-closed on a non-canonical uuid in the (tamper-able)
@@ -4026,12 +2572,9 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_refuses_non_canonical_uuid() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let mut entry = entry.unwrap();
+        let mut entry = legacy_vendor(root, &record).await;
         entry.uuid = "../../escape".to_string();
 
         let outcome = revert_maven(&entry, root, false).await;
@@ -4064,12 +2607,9 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_unrecognized_wiring_kind_warns_and_keeps_the_referenced_artifact() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let mut entry = entry.unwrap();
+        let mut entry = legacy_vendor(root, &record).await;
         entry.wiring[0].kind = "bogus".to_string();
         let wired = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
 
@@ -4110,12 +2650,9 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_tolerates_wiring_key_missing() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let mut entry = entry.unwrap();
+        let mut entry = legacy_vendor(root, &record).await;
         entry.wiring[0].key = None;
         let wired = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
 
@@ -4154,12 +2691,9 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_tolerates_wiring_original_missing() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let mut entry = entry.unwrap();
+        let mut entry = legacy_vendor(root, &record).await;
         entry.wiring[0].original = None;
         let wired = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
 
@@ -4198,12 +2732,9 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_missing_new_snapshot_excises_block() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let mut entry = entry.unwrap();
+        let mut entry = legacy_vendor(root, &record).await;
         entry.wiring[0].new = None;
 
         let outcome = revert_maven(&entry, root, false).await;
@@ -4238,12 +2769,9 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_with_pom_deleted_still_removes_artifact() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
         tokio::fs::remove_file(root.join(PROJECT_POM))
             .await
             .unwrap();
@@ -4276,13 +2804,10 @@ mod tests {
     #[serial_test::serial]
     async fn revert_remove_tree_failure_reported() {
         use std::os::unix::fs::PermissionsExt as _;
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
         let pom_before = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
 
         // A read-only parent blocks the final rmdir of the uuid dir (unlinking
         // an entry needs write on its parent; the uuid dir's parent is the
@@ -4296,264 +2821,52 @@ mod tests {
             let _ = std::fs::remove_file(maven_dir.join(".probe"));
             tokio::fs::set_permissions(&maven_dir, std::fs::Permissions::from_mode(0o755))
                 .await
-                .unwrap();
-            return;
-        }
-        let outcome = revert_maven(&entry, root, false).await;
-        tokio::fs::set_permissions(&maven_dir, std::fs::Permissions::from_mode(0o755))
-            .await
-            .unwrap();
-
-        assert!(!outcome.success, "a failed deletion must fail the revert");
-        let uuid_dir = root.join(format!(".socket/vendor/maven/{UUID}"));
-        assert!(
-            outcome.error.as_deref().is_some_and(
-                |e| e.contains("failed to remove") && e.contains(&*uuid_dir.to_string_lossy())
-            ),
-            "error names the undeletable uuid dir: {:?}",
-            outcome.error
-        );
-        assert!(uuid_dir.exists(), "the uuid dir survives for a retry");
-        // Partial-revert semantics: the wiring restore ran BEFORE the deletion.
-        assert_eq!(
-            tokio::fs::read(root.join(PROJECT_POM)).await.unwrap(),
-            pom_before,
-            "pom.xml was already restored when the deletion failed"
-        );
-    }
-
-    /// Service Tier A: the verified prebuilt jar bytes are written VERBATIM —
-    /// vendored jar, sha1 sidecar, and the ledger sha256 all describe the
-    /// service bytes, and pom.xml is wired.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn service_prebuilt_jar_written_verbatim() {
-        use wiremock::matchers::{method, path};
-        use wiremock::{Mock, MockServer, ResponseTemplate};
-
-        let body = make_jar(PATCHED);
-        let sri = crate::vendor::npm_pack::PackedTarball::from_bytes(&body).integrity;
-        let serve_path = "/patch/maven/commons-text/1.10.0/tok/uuid/commons-text-1.10.0.jar";
-        let server = MockServer::start().await;
-        let serve_url = format!("{}{serve_path}", server.uri());
-        Mock::given(method("POST"))
-            .and(path("/v0/orgs/acme/patches/package"))
-            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
-                "results": { UUID: {
-                    "status": "granted",
-                    "url": serve_url,
-                    "artifacts": [{ "kind": "tarball", "url": serve_url,
-                                    "integrity": { "sha512": sri } }]
-                }}
-            })))
-            .mount(&server)
-            .await;
-        Mock::given(method("GET"))
-            .and(path(serve_path))
-            .respond_with(ResponseTemplate::new(200).set_body_bytes(body.clone()))
-            .mount(&server)
-            .await;
-
-        // No local jar: under --vendor-source=service the bytes MUST come from
-        // the service (a local rebuild is impossible here anyway).
-        let (dir, blobs, installed, record) =
-            fixture(Some(project_pom()), /*with_local_jar=*/ false, true).await;
-        let root = dir.path();
-        let cfg = service_cfg(
-            Some(&server.uri()),
-            crate::vendor::VendorSource::Service,
-            false,
-        );
-        let (result, entry, warnings) =
-            unwrap_done(run_vendor_with_service(root, &blobs, &installed, &record, &cfg).await);
-        assert!(result.success, "{:?}", result.error);
-        assert!(
-            warnings
-                .iter()
-                .any(|w| w.code == "vendor_prebuilt_downloaded"),
-            "the service download is surfaced: {warnings:?}"
-        );
-        assert_eq!(
-            tokio::fs::read(root.join(jar_rel())).await.unwrap(),
-            body,
-            "the service bytes are written verbatim"
-        );
-        let jar_sha1 = tokio::fs::read_to_string(root.join(format!("{}.sha1", jar_rel())))
-            .await
-            .unwrap();
-        assert_eq!(jar_sha1.trim(), sha1_hex(&body));
-        let entry = entry.expect("success carries a ledger entry");
-        assert_eq!(
-            entry.artifact.sha256,
-            hex::encode(Sha256::digest(&body)),
-            "the ledger sha256 describes the service bytes"
-        );
-        let pom_xml = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        assert!(pom_xml.contains(&format!("socket-patch-vendor-{UUID}")));
-    }
-
-    /// --vendor-source=service + --offline is a fail-closed conflict, refused
-    /// before any write.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn service_mode_offline_refuses_before_any_write() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let cfg = service_cfg(
-            None,
-            crate::vendor::VendorSource::Service,
-            /*offline=*/ true,
-        );
-        let (code, _d) =
-            unwrap_refused(run_vendor_with_service(root, &blobs, &installed, &record, &cfg).await);
-        assert_eq!(code, "vendor_service_offline_conflict");
-        assert!(!root.join(".socket").exists(), "refusal writes nothing");
-        let pom_xml = tokio::fs::read_to_string(root.join(PROJECT_POM))
-            .await
-            .unwrap();
-        assert!(!pom_xml.contains("socket-patch-vendor"));
-    }
-
-    /// write_maven_artifact failure (a regular file squatting on the maven2
-    /// group path): failed result + the whole uuid dir cleaned up.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn leaf_write_failure_fails_and_cleans_up() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let uuid_dir = root.join(format!(".socket/vendor/maven/{UUID}"));
-        tokio::fs::create_dir_all(&uuid_dir).await.unwrap();
-        // create_dir_all of <uuid>/org/... fails on the planted regular file.
-        tokio::fs::write(uuid_dir.join("org"), b"squatter")
-            .await
-            .unwrap();
-
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(!result.success, "a failed leaf write cannot succeed");
-        assert!(
-            result
-                .error
-                .as_deref()
-                .is_some_and(|e| e.contains("cannot create")),
-            "failure names the uncreatable leaf dir: {:?}",
-            result.error
-        );
-        assert!(entry.is_none());
-        assert!(
-            !uuid_dir.exists(),
-            "cleanup removes the uuid dir including the squatter"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(PROJECT_POM))
-                .await
-                .unwrap(),
-            project_pom(),
-            "pom.xml never wired"
-        );
-    }
-
-    /// The full registry pom-download leg (no local pom, service enabled): the
-    /// pom is fetched from SOCKET_MAVEN_REGISTRY (trailing slash trimmed) under
-    /// the Maven CLI UA, vendored verbatim with a matching sidecar, and the
-    /// download is surfaced as a warning. The service's own package endpoint
-    /// missing (404) falls back to the local jar rebuild under `auto`.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn registry_pom_download_vendors_downloaded_pom() {
-        use wiremock::matchers::{header, method, path};
-        use wiremock::{Mock, MockServer, ResponseTemplate};
-
-        let server = MockServer::start().await;
-        crate::vendor::test_support::mount_granted(
-            &server,
-            UUID,
-            "commons-text-1.10.0.jar",
-            &make_jar(PATCHED),
-        )
-        .await;
-        let pom_route = "/org/apache/commons/commons-text/1.10.0/commons-text-1.10.0.pom";
-        Mock::given(method("GET"))
-            .and(path(pom_route))
-            .and(header("user-agent", MAVEN_USER_AGENT))
-            .respond_with(ResponseTemplate::new(200).set_body_bytes(UPSTREAM_POM.to_vec()))
-            .expect(1)
-            .mount(&server)
-            .await;
-        // Trailing slash pins the trim in maven_registry_base().
-        let _reg = EnvGuard::set("SOCKET_MAVEN_REGISTRY", &format!("{}/", server.uri()));
+                .unwrap();
+            return;
+        }
+        let outcome = revert_maven(&entry, root, false).await;
+        tokio::fs::set_permissions(&maven_dir, std::fs::Permissions::from_mode(0o755))
+            .await
+            .unwrap();
 
-        let (dir, blobs, installed, record) =
-            fixture(Some(project_pom()), true, /*with_local_pom=*/ false).await;
-        let root = dir.path();
-        let cfg = service_cfg(
-            Some(&server.uri()),
-            crate::vendor::VendorSource::Service,
-            false,
-        );
-        let (result, entry, warnings) =
-            unwrap_done(run_vendor_with_service(root, &blobs, &installed, &record, &cfg).await);
-        assert!(result.success, "{:?}", result.error);
-        assert!(entry.is_some());
+        assert!(!outcome.success, "a failed deletion must fail the revert");
+        let uuid_dir = root.join(format!(".socket/vendor/maven/{UUID}"));
         assert!(
-            warnings
-                .iter()
-                .any(|w| w.code == "vendor_maven_pom_downloaded"),
-            "the pom download is surfaced: {warnings:?}"
+            outcome.error.as_deref().is_some_and(
+                |e| e.contains("failed to remove") && e.contains(&*uuid_dir.to_string_lossy())
+            ),
+            "error names the undeletable uuid dir: {:?}",
+            outcome.error
         );
-        let vendored_pom = root.join(format!("{}/commons-text-1.10.0.pom", leaf_rel()));
+        assert!(uuid_dir.exists(), "the uuid dir survives for a retry");
+        // Partial-revert semantics: the wiring restore ran BEFORE the deletion.
         assert_eq!(
-            tokio::fs::read(&vendored_pom).await.unwrap(),
-            UPSTREAM_POM,
-            "the downloaded pom is vendored verbatim"
+            tokio::fs::read(root.join(PROJECT_POM)).await.unwrap(),
+            pom_before,
+            "pom.xml was already restored when the deletion failed"
         );
-        let pom_sha1 = tokio::fs::read_to_string(
-            root.join(format!("{}/commons-text-1.10.0.pom.sha1", leaf_rel())),
-        )
-        .await
-        .unwrap();
-        assert_eq!(pom_sha1.trim(), sha1_hex(UPSTREAM_POM));
     }
 
-    /// The registry pom download failing (404) maps to the pom_unavailable
-    /// refusal with nothing written — never a fabricated minimal pom.
+    /// --vendor-source=service + --offline is a fail-closed conflict, refused
+    /// before any write.
     #[tokio::test]
     #[serial_test::serial]
-    async fn registry_pom_download_failure_maps_to_pom_unavailable() {
-        use wiremock::MockServer;
-
-        let server = MockServer::start().await;
-        crate::vendor::test_support::mount_granted(
-            &server,
-            UUID,
-            "commons-text-1.10.0.jar",
-            &make_jar(PATCHED),
-        )
-        .await;
-        // The pom route is NOT mounted → wiremock answers 404.
-        let _reg = EnvGuard::set("SOCKET_MAVEN_REGISTRY", &server.uri());
-
-        let (dir, blobs, installed, record) =
-            fixture(Some(project_pom()), true, /*with_local_pom=*/ false).await;
+    async fn service_mode_offline_refuses_before_any_write() {
+        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
         let cfg = service_cfg(
-            Some(&server.uri()),
+            None,
             crate::vendor::VendorSource::Service,
-            false,
+            /*offline=*/ true,
         );
-        let (code, detail) =
+        let (code, _d) =
             unwrap_refused(run_vendor_with_service(root, &blobs, &installed, &record, &cfg).await);
-        assert_eq!(code, "vendor_maven_pom_unavailable");
-        assert!(
-            detail.contains("registry fetch failed"),
-            "refusal names the failed download: {detail}"
-        );
-        assert!(
-            !root.join(".socket").exists(),
-            "nothing written before the pom step"
-        );
+        assert_eq!(code, "vendor_service_offline_conflict");
+        assert!(!root.join(".socket").exists(), "refusal writes nothing");
+        let pom_xml = tokio::fs::read_to_string(root.join(PROJECT_POM))
+            .await
+            .unwrap();
+        assert!(!pom_xml.contains("socket-patch-vendor"));
     }
 
     /// fetch_pom_bytes rejects a non-2xx response with the status in the error.
@@ -4597,106 +2910,14 @@ mod tests {
         assert!(err.contains("cap"), "{err}");
     }
 
-    /// A missing `.sha1` sidecar (file intact) reads as stale — checksumPolicy
-    /// integrity is self-healing via the artifact rebuild.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn missing_sidecar_reads_stale_and_rebuilds() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let (r1, _e, _w) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r1.success);
-        let sidecar = root.join(format!("{}/commons-text-1.10.0.pom.sha1", leaf_rel()));
-        tokio::fs::remove_file(&sidecar).await.unwrap();
-
-        let (r2, e2, w2) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r2.success, "{:?}", r2.error);
-        assert!(
-            e2.is_some_and(|e| e.wiring.is_empty()),
-            "artifact-only rebuild refreshes the fingerprint, never the wiring"
-        );
-        assert!(
-            w2.iter().any(|w| w.code == "vendor_artifact_rebuilt"),
-            "a missing sidecar must read as stale and rebuild: {w2:?}"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(&sidecar).await.unwrap().trim(),
-            sha1_hex(UPSTREAM_POM),
-            "the sidecar is restored to match the vendored pom"
-        );
-    }
-
-    /// profiles_spans edge branches: a `<profilesX>` decoy and a self-closing
-    /// `<profiles/>` must NOT mask the real `<repositories>`; an unclosed
-    /// `<profiles>` masks to EOF fail-closed; a name-at-EOF open masks too.
-    #[test]
-    #[serial_test::serial]
-    fn profiles_masking_edge_branches() {
-        // Decoy: <profilesX> is not <profiles> — the real section is wireable.
-        let decoy =
-            "<project><profilesX>x</profilesX>\n  <repositories>\n  </repositories>\n</project>\n";
-        let out =
-            build_repo_edit(decoy, "socket-patch-vendor-x", ".socket/vendor/maven/x").unwrap();
-        assert!(out.contains("<id>socket-patch-vendor-x</id>"));
-        assert_eq!(
-            out.matches("</repositories>").count(),
-            1,
-            "the existing section is extended, not a new one created: {out}"
-        );
-
-        // Self-closing <profiles/> spans nothing — the section stays wireable.
-        let self_closing =
-            "<project><profiles/>\n  <repositories>\n  </repositories>\n</project>\n";
-        let out = build_repo_edit(
-            self_closing,
-            "socket-patch-vendor-x",
-            ".socket/vendor/maven/x",
-        )
-        .unwrap();
-        assert!(out.contains("<id>socket-patch-vendor-x</id>"));
-        assert_eq!(
-            out.matches("</repositories>").count(),
-            1,
-            "a self-closing <profiles/> must not mask: {out}"
-        );
-
-        // Unclosed <profiles> masks through EOF — BOTH anchors are swallowed,
-        // so the edit fails closed rather than wiring a block Maven may skip.
-        let unclosed = "<project><profiles>\n  <repositories>\n  </repositories>\n</project>\n";
-        let err = build_repo_edit(unclosed, "socket-patch-vendor-x", ".socket/vendor/maven/x")
-            .unwrap_err();
-        assert!(err.contains("no </project>"), "{err}");
-
-        // Open-tag name running to EOF masks to EOF too.
-        assert_eq!(profiles_spans("<project><profiles", &[]), vec![(9, 18)]);
-    }
-
-    /// declares_modules fail-closed edges: an unterminated comment drops its
-    /// tail (never counts), a truncated `<modules` at EOF counts.
-    #[test]
-    #[serial_test::serial]
-    fn declares_modules_fail_closed_edges() {
-        assert!(
-            !declares_modules("<project><!-- <modules>"),
-            "an unterminated comment's tail is dropped"
-        );
-        assert!(
-            declares_modules("<project><modules"),
-            "a truncated pom ending at <modules counts as declaring modules"
-        );
-    }
-
     /// Dry-run revert on the byte-identical fast path: reports success, warns
     /// nothing, and touches neither pom.xml nor the artifact.
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_dry_run_touches_nothing_on_fast_path() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
         let wired = tokio::fs::read(root.join(PROJECT_POM)).await.unwrap();
 
         let outcome = revert_maven(&entry, root, /*dry_run=*/ true).await;
@@ -4724,12 +2945,9 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial]
     async fn revert_dry_run_touches_nothing_on_excise_path() {
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+        let (dir, _, _, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success);
-        let entry = entry.unwrap();
+        let entry = legacy_vendor(root, &record).await;
 
         // A user edit after vendoring forces the excise path.
         let wired = tokio::fs::read_to_string(root.join(PROJECT_POM))
@@ -4781,84 +2999,6 @@ mod tests {
         assert_eq!(strip_empty_repositories(no_close), no_close);
     }
 
-    // ── source-flip regression: the hot path decides "in sync" from the
-    //    COMMITTED copy before any service call, so a service ↔ local flip
-    //    between runs is a byte-identical no-op with no request. ──
-
-    /// A service jar: same members, STORED — bytes distinct from the local
-    /// deflate re-zip, as a real service build would be.
-    async fn flip_granted_jar() -> (wiremock::MockServer, Vec<u8>) {
-        use std::io::Write as _;
-        use wiremock::matchers::{method, path};
-        use wiremock::{Mock, MockServer, ResponseTemplate};
-        let body = {
-            let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
-            let opts = zip::write::SimpleFileOptions::default()
-                .compression_method(zip::CompressionMethod::Stored);
-            for (name, bytes) in [
-                ("META-INF/MANIFEST.MF", &b"Manifest-Version: 1.0\n"[..]),
-                (JAR_FILE, PATCHED),
-                (
-                    "org/apache/commons/text/StringSubstitutor.class",
-                    &b"\xca\xfe\xba\xbe-fake-class"[..],
-                ),
-            ] {
-                zw.start_file(name, opts).unwrap();
-                zw.write_all(bytes).unwrap();
-            }
-            zw.finish().unwrap().into_inner()
-        };
-        let sri = crate::vendor::test_support::sri(&body);
-        let serve_path = "/patch/maven/commons-text/1.10.0/tok/uuid/commons-text-1.10.0.jar";
-        let server = MockServer::start().await;
-        let serve_url = format!("{}{serve_path}", server.uri());
-        Mock::given(method("POST"))
-            .and(path("/v0/orgs/acme/patches/package"))
-            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
-                "results": { UUID: {
-                    "status": "granted", "url": serve_url,
-                    "artifacts": [{ "kind": "tarball", "url": serve_url,
-                                    "integrity": { "sha512": sri } }]
-                }}
-            })))
-            .mount(&server)
-            .await;
-        Mock::given(method("GET"))
-            .and(path(serve_path))
-            .respond_with(ResponseTemplate::new(200).set_body_bytes(body.clone()))
-            .mount(&server)
-            .await;
-        (server, body)
-    }
-
-    fn flip_cfg(s: &wiremock::MockServer) -> VendorServiceConfig {
-        service_cfg(Some(&s.uri()), crate::vendor::VendorSource::Service, false)
-    }
-
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn flip_service_then_local_is_noop() {
-        use crate::vendor::test_support as ts;
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let (up, served) = flip_granted_jar().await;
-        let (r1, e1, _) = unwrap_done(
-            run_vendor_with_service(root, &blobs, &installed, &record, &flip_cfg(&up)).await,
-        );
-        assert!(r1.success && e1.is_some());
-        assert_eq!(tokio::fs::read(root.join(jar_rel())).await.unwrap(), served);
-        let before = ts::tree_snapshot(root);
-        let down = wiremock::MockServer::start().await;
-        ts::mount_503(&down).await;
-        let (r2, e2, _) = unwrap_done(
-            run_vendor_with_service(root, &blobs, &installed, &record, &flip_cfg(&down)).await,
-        );
-        assert!(r2.success);
-        assert!(e2.is_none());
-        assert_eq!(before, ts::tree_snapshot(root));
-        assert_eq!(ts::request_count(&down).await, 0);
-    }
-
     /// Mount a granted service response serving `body` as the prebuilt jar.
     async fn mount_granted_jar(body: &[u8]) -> wiremock::MockServer {
         use wiremock::matchers::{method, path};
@@ -4887,89 +3027,6 @@ mod tests {
         server
     }
 
-    /// The wired-but-missing rebuild must hand back a refreshed
-    /// ledger entry. Vendored from the service, the committed jar is lost and
-    /// rebuilt LOCALLY (different bytes); the ledger the CLI persists (the
-    /// refreshed entry carried forward over the first, or the first when the
-    /// backend returns None) must describe the rebuilt jar.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn wired_rebuild_refreshes_ledger_sha256() {
-        // A service build: same members, STORED (uncompressed), so its bytes
-        // differ from the local deflate re-zip as a real service jar's would.
-        let served = {
-            let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
-            let opts = zip::write::SimpleFileOptions::default()
-                .compression_method(zip::CompressionMethod::Stored);
-            for (name, bytes) in [
-                ("META-INF/MANIFEST.MF", &b"Manifest-Version: 1.0\n"[..]),
-                (JAR_FILE, PATCHED),
-                (
-                    "org/apache/commons/text/StringSubstitutor.class",
-                    &b"\xca\xfe\xba\xbe-fake-class"[..],
-                ),
-            ] {
-                zw.start_file(name, opts).unwrap();
-                zw.write_all(bytes).unwrap();
-            }
-            zw.finish().unwrap().into_inner()
-        };
-        let server = mount_granted_jar(&served).await;
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let cfg = service_cfg(
-            Some(&server.uri()),
-            crate::vendor::VendorSource::Service,
-            false,
-        );
-        let (r1, e1, _w1) =
-            unwrap_done(run_vendor_with_service(root, &blobs, &installed, &record, &cfg).await);
-        assert!(r1.success, "{:?}", r1.error);
-        let e1 = e1.expect("first vendor records an entry");
-        assert_eq!(
-            crate::vendor::check_vendored_artifact(root, &e1, &record).await,
-            crate::vendor::ArtifactHealth::Healthy
-        );
-
-        tokio::fs::remove_file(root.join(jar_rel())).await.unwrap();
-        // Local rebuild (no service).
-        let (r2, e2, w2) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(r2.success, "{:?}", r2.error);
-        assert!(
-            w2.iter().any(|w| w.code == "vendor_artifact_rebuilt"),
-            "{w2:?}"
-        );
-        let rebuilt = tokio::fs::read(root.join(jar_rel())).await.unwrap();
-        assert!(rebuilt == served, "the service fixture remains immutable");
-
-        let ledger = match e2 {
-            Some(mut fresh) => {
-                crate::vendor::carry_forward_wiring(&e1, &mut fresh);
-                fresh
-            }
-            None => e1.clone(),
-        };
-        assert_eq!(
-            ledger.artifact.sha256,
-            hex::encode(Sha256::digest(&rebuilt)),
-            "the ledger fingerprint must describe the rebuilt jar"
-        );
-        assert_eq!(
-            crate::vendor::check_vendored_artifact(root, &ledger, &record).await,
-            crate::vendor::ArtifactHealth::Healthy
-        );
-        // The carried-forward pom.xml wiring still reverts cleanly.
-        assert_eq!(ledger.wiring, e1.wiring, "pom.xml revert record preserved");
-        let rv = revert_maven(&ledger, root, false).await;
-        assert!(rv.success, "{:?}", rv.error);
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(PROJECT_POM))
-                .await
-                .unwrap(),
-            project_pom()
-        );
-    }
-
     /// A served jar that passes the SRI floor but whose patched
     /// member does NOT carry the record's afterHash must never be accepted.
     /// Under `service` it is a refusal with nothing written.
@@ -5377,6 +3434,48 @@ mod tests {
         assert!(root.join("src/Main.java").is_file());
     }
 
+    /// A module of an ancestor Maven reactor is refused `not_build_root`
+    /// by both [`vendor_maven`] and [`jvm_gate_preflight`], so a hosted
+    /// pin is kept rather than restored before a refusal that writes
+    /// nothing; the reactor root itself passes the preflight.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn maven_reactor_module_refuses_not_build_root_in_preflight() {
+        let (dir, blobs, installed, record) = fixture(None, true, true).await;
+        let root = dir.path();
+        std::fs::create_dir_all(root.join(".git")).unwrap();
+        std::fs::write(
+            root.join("pom.xml"),
+            "<project><modelVersion>4.0.0</modelVersion><groupId>com.example</groupId>\
+             <artifactId>parent</artifactId><version>1.0</version><packaging>pom</packaging>\
+             <modules><module>app</module></modules></project>\n",
+        )
+        .unwrap();
+        let module = root.join("app");
+        std::fs::create_dir_all(&module).unwrap();
+        std::fs::write(
+            module.join("pom.xml"),
+            "<project><modelVersion>4.0.0</modelVersion><parent><groupId>com.example</groupId>\
+             <artifactId>parent</artifactId><version>1.0</version></parent>\
+             <artifactId>app</artifactId></project>\n",
+        )
+        .unwrap();
+        let before = crate::vendor::test_support::tree_snapshot(root);
+        let (code, detail) = jvm_gate_preflight(&module, PURL).await.unwrap_err();
+        assert_eq!(code, "vendor_jvm_shape_unsupported");
+        assert!(
+            detail.starts_with("reason: not_build_root: run vendor from reactor root "),
+            "{detail}"
+        );
+        let (code, vendor_detail) =
+            unwrap_refused(run_vendor(&module, &blobs, &installed, &record, false).await);
+        assert_eq!(code, "vendor_jvm_shape_unsupported");
+        assert_eq!(vendor_detail, detail);
+        assert_eq!(crate::vendor::test_support::tree_snapshot(root), before);
+        assert!(service_preflight(PURL, &module, &record).await.is_none());
+        assert!(jvm_gate_preflight(root, PURL).await.is_ok());
+    }
+
     /// #428: vendoring from a project of a Gradle build rooted above it
     /// (a literal or relocated include, includes that cannot be read, or a
     /// project with no settings of its own) refuses with `not_build_root`
@@ -5530,70 +3629,206 @@ mod tests {
         );
     }
 
-    /// A previously vendored project keeps routing to the JVM backend when the
-    /// switch is unset (its ledger names a JVM entry).
+    /// A ledger of JVM entries is not a legacy root.
     #[tokio::test]
     #[serial_test::serial]
-    async fn jvm_routing_follows_the_ledger() {
+    async fn jvm_entries_are_not_a_legacy_root() {
         let (dir, blobs, installed, record) = reactor_fixture(true).await;
         let root = dir.path();
-        assert!(jvm_shape(root).await.is_some());
         let (_, entry, _) = unwrap_done(run_jvm(root, &blobs, &installed, &record, None).await);
-        let mut state = super::super::state::VendorState::new();
-        state.entries.insert(PURL.to_string(), entry.unwrap());
-        super::super::state::save_state(root, &state).await.unwrap();
-        assert_eq!(
-            jvm_shape(root).await,
-            Some(super::super::jvm::Shape::MavenReactor)
-        );
+        crate::vendor::test_support::persist(root, PURL, entry.unwrap()).await;
+        assert!(!legacy_root(root).await);
+        assert_eq!(detect_shape(root), super::super::jvm::Shape::MavenReactor);
+    }
+
+    // ── #973: single-module poms through the planner ──
+
+    /// A pre-v5 single-pom vendoring of `record` over the project pom, as
+    /// the retired backend left it: the `.socket/vendor/maven/<uuid>` maven2
+    /// tree, a `<repositories>` section before `</project>` and the
+    /// `maven_pom_repository` ledger record (not persisted).
+    async fn legacy_vendor(root: &Path, record: &PatchRecord) -> VendorEntry {
+        let original = std::fs::read_to_string(root.join(PROJECT_POM)).unwrap();
+        let jar = make_jar(PATCHED);
+        write_maven_artifact(
+            &root.join(leaf_rel()),
+            "commons-text-1.10.0.jar",
+            &jar,
+            "commons-text-1.10.0.pom",
+            UPSTREAM_POM,
+        )
+        .await
+        .unwrap();
+        let repo_id = format!("{VENDOR_REPO_ID_PREFIX}{}", record.uuid);
+        let at = original.rfind("</project>").unwrap();
+        let wired = format!(
+            "{}  <repositories>\n{}  </repositories>\n{}",
+            &original[..at],
+            repository_block(&repo_id, &format!(".socket/vendor/maven/{}", record.uuid)),
+            &original[at..]
+        );
+        std::fs::write(root.join(PROJECT_POM), &wired).unwrap();
+        maven_entry(
+            PURL.to_string(),
+            record,
+            jar_rel(),
+            &jar,
+            vec![WiringRecord {
+                file: PROJECT_POM.to_string(),
+                kind: REPO_WIRING_KIND.to_string(),
+                action: WiringAction::Added,
+                key: Some(repo_id),
+                original: Some(Value::String(original)),
+                new: Some(Value::String(wired)),
+            }],
+        )
     }
 
-    /// A single-pom root vendored on the single-pom backend before mixed
-    /// roots were planned as one JVM entry keeps that backend once a Gradle
-    /// build sits beside it: the re-run warns that the Gradle build stays
-    /// unpatched and writes no JVM wiring, and the revert restores pom.xml
-    /// exactly. Without such an entry the same root is mixed.
+    /// A lone single-module pom is a reactor of one: a `jvm` entry with a
+    /// suffixed pin, `.mvn/maven.config` and the `maven2` tree, the
+    /// wrapper-less warnings, an in-sync re-run that writes nothing, and a
+    /// byte-exact revert (LF and CRLF poms).
     #[tokio::test]
     #[serial_test::serial]
-    async fn legacy_single_pom_entry_keeps_a_mixed_root_on_its_backend() {
-        use super::super::jvm::Shape;
-        let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
-        let root = dir.path();
-        let (_, entry, _) = unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        let entry = entry.unwrap();
-        assert_eq!(entry.ecosystem, "maven");
-        let mut state = super::super::state::VendorState::new();
-        state.entries.insert(PURL.to_string(), entry.clone());
-        super::super::state::save_state(root, &state).await.unwrap();
-        std::fs::write(root.join("settings.gradle"), "rootProject.name = 'app'\n").unwrap();
-        assert_eq!(jvm_shape(root).await, None);
-
-        let (result, _, warnings) =
-            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{result:?}");
-        assert!(
-            warnings.iter().any(|w| w.code == "vendor_jvm_degraded"
-                && w.detail.starts_with("reason: legacy_maven_root: ")),
-            "{warnings:?}"
-        );
-        assert!(!root.join(".socket/gradle").exists());
-        assert!(!root.join(".socket/vendor/gradle").exists());
-        assert_eq!(
-            std::fs::read_to_string(root.join("settings.gradle")).unwrap(),
-            "rootProject.name = 'app'\n"
-        );
+    async fn single_module_pom_vendors_through_the_planner() {
+        for crlf in [false, true] {
+            let pom = if crlf {
+                project_pom().replace('\n', "\r\n")
+            } else {
+                project_pom().to_string()
+            };
+            let (dir, blobs, installed, record) = fixture(Some(&pom), true, true).await;
+            let root = dir.path();
+            let before = crate::vendor::test_support::tree_snapshot(root);
+            assert!(service_preflight(PURL, root, &record).await.is_some());
+
+            let (result, entry, warnings) =
+                unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
+            assert!(result.success, "crlf={crlf}: {:?}", result.error);
+            let entry = entry.expect("ledger entry");
+            assert_eq!(entry.ecosystem, layout::LEDGER_ECOSYSTEM);
+            assert!(super::super::jvm::apply::is_jvm_entry(&entry));
+            assert!(
+                entry.artifact.path.starts_with(
+                    ".socket/vendor/maven2/org/apache/commons/commons-text/1.10.0-socket."
+                ),
+                "{}",
+                entry.artifact.path
+            );
+            let jar = std::fs::read(root.join(&entry.artifact.path)).unwrap();
+            assert_eq!(read_jar_entry(&jar, JAR_FILE).as_deref(), Some(PATCHED));
+            let wired = std::fs::read_to_string(root.join(PROJECT_POM)).unwrap();
+            assert!(wired.contains("<version>1.10.0-socket."), "{wired}");
+            assert!(!wired.contains(VENDOR_REPO_URL_PREFIX), "{wired}");
+            assert!(root.join(".mvn/maven.config").is_file());
+            assert!(!root.join(".socket/vendor/maven").exists());
+            // No Maven Wrapper: both wrapper-less warnings.
+            for reason in ["maven_f_outside_root", "maven_mirror_of_all"] {
+                assert!(
+                    warnings
+                        .iter()
+                        .any(|w| w.code == super::super::jvm::gradle::DEGRADED
+                            && w.detail.starts_with(&format!("reason: {reason}: "))),
+                    "crlf={crlf}: {reason}: {warnings:?}"
+                );
+            }
+            assert!(
+                !warnings
+                    .iter()
+                    .any(|w| w.code == "vendor_maven_local_cache_shadow"),
+                "{warnings:?}"
+            );
+            crate::vendor::test_support::persist(root, PURL, entry.clone()).await;
 
-        let outcome = revert_maven(&entry, root, false).await;
-        assert!(outcome.success, "{outcome:?}");
-        assert!(outcome.warnings.is_empty(), "{:?}", outcome.warnings);
-        assert_eq!(
-            std::fs::read_to_string(root.join(PROJECT_POM)).unwrap(),
-            project_pom()
-        );
-        super::super::state::save_state(root, &super::super::state::VendorState::new())
-            .await
-            .unwrap();
-        assert_eq!(jvm_shape(root).await, Some(Shape::Mixed));
+            let snapshot = crate::vendor::test_support::tree_snapshot(root);
+            let (result, again, _) =
+                unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
+            assert!(result.success && again.is_none(), "crlf={crlf}: {result:?}");
+            assert_eq!(crate::vendor::test_support::tree_snapshot(root), snapshot);
+            assert!(service_preflight(PURL, root, &record).await.is_none());
+
+            let out = revert_maven(&entry, root, false).await;
+            assert!(
+                out.success && out.warnings.is_empty(),
+                "crlf={crlf}: {out:?}"
+            );
+            assert_eq!(
+                std::fs::read(root.join(PROJECT_POM)).unwrap(),
+                pom.as_bytes()
+            );
+            assert!(!root.join(".mvn").exists());
+            let mut after = crate::vendor::test_support::tree_snapshot(root);
+            after.remove(".socket/vendor/state.json");
+            assert_eq!(after, before, "crlf={crlf}");
+        }
+    }
+
+    /// A root whose ledger holds a pre-v5 `maven_pom_repository` entry is
+    /// refused whole (`legacy_maven_root`), single or beside a Gradle
+    /// build, with nothing written and no service call or hosted restore
+    /// planned. After `vendor --revert` it vendors through the planner.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn legacy_maven_root_is_refused_until_reverted() {
+        for mixed in [false, true] {
+            let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
+            let root = dir.path();
+            if mixed {
+                std::fs::write(root.join("settings.gradle"), "rootProject.name = 'app'\n").unwrap();
+            }
+            let legacy = legacy_vendor(root, &record).await;
+            crate::vendor::test_support::persist(root, PURL, legacy.clone()).await;
+            let before = crate::vendor::test_support::tree_snapshot(root);
+
+            let (code, detail) =
+                unwrap_refused(run_vendor(root, &blobs, &installed, &record, false).await);
+            assert_eq!(code, "vendor_jvm_shape_unsupported", "mixed={mixed}");
+            assert!(
+                detail.starts_with("reason: legacy_maven_root: ")
+                    && detail.contains("socket-patch vendor --revert"),
+                "mixed={mixed}: {detail}"
+            );
+            // A second patch uuid is refused the same way.
+            let other = PatchRecord {
+                uuid: crate::vendor::test_support::PLAN_UUID_B.to_string(),
+                ..record.clone()
+            };
+            let (code, _) =
+                unwrap_refused(run_vendor(root, &blobs, &installed, &other, false).await);
+            assert_eq!(code, "vendor_jvm_shape_unsupported");
+            assert_eq!(
+                crate::vendor::test_support::tree_snapshot(root),
+                before,
+                "mixed={mixed}"
+            );
+            assert!(service_preflight(PURL, root, &other).await.is_none());
+            let (code, detail) = jvm_gate_preflight(root, PURL).await.unwrap_err();
+            assert_eq!(code, "vendor_jvm_shape_unsupported");
+            assert!(
+                detail.starts_with("reason: legacy_maven_root: "),
+                "{detail}"
+            );
+
+            // `vendor --revert`: the pom comes back byte for byte, the
+            // ledger empties, and vendoring then plans the root.
+            let out = revert_maven(&legacy, root, false).await;
+            assert!(out.success && out.warnings.is_empty(), "{out:?}");
+            assert_eq!(
+                std::fs::read_to_string(root.join(PROJECT_POM)).unwrap(),
+                project_pom()
+            );
+            assert!(!root.join(".socket/vendor/maven").exists());
+            super::super::state::save_state(root, &super::super::state::VendorState::new())
+                .await
+                .unwrap();
+            let (result, entry, _) =
+                unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
+            assert!(result.success, "mixed={mixed}: {:?}", result.error);
+            assert_eq!(entry.unwrap().ecosystem, layout::LEDGER_ECOSYSTEM);
+            assert!(std::fs::read_to_string(root.join(PROJECT_POM))
+                .unwrap()
+                .contains("1.10.0-socket."));
+        }
     }
 
     /// Offline sourcing (#533, #511): a Gradle copy counts only in the hash
diff --git a/crates/socket-patch-core/src/vendor/mod.rs b/crates/socket-patch-core/src/vendor/mod.rs
index 0e9477a15..6550de2b7 100644
--- a/crates/socket-patch-core/src/vendor/mod.rs
+++ b/crates/socket-patch-core/src/vendor/mod.rs
@@ -19,7 +19,7 @@
 //! | composer | package dir         | composer.lock `dist` → `{type: path}`          |
 //! | gem      | gem dir (+gemspec)  | Gemfile `path:` + Gemfile.lock PATH pair       |
 //! | pypi     | rebuilt wheel       | per manifest flavor: uv, poetry, pdm, pipenv, requirements ([`pypi`] routes) |
-//! | maven    | rebuilt jar         | committed `file://` maven2 repo + pom `<repository>` ([`maven_repo`]) |
+//! | maven    | patched jar         | suffixed `<version>-socket.<hex8>` tree under `.socket/vendor/maven2` + pom pin, `.mvn/maven.config` (or Gradle / sbt / scala-cli wiring) ([`maven_repo`] routes to [`jvm`]) |
 //! | nuget    | rebuilt nupkg       | folder feed + `nuget.config` + `packages.lock.json` pin ([`nuget_feed`]) |
 //!
 //! npm requests route through [`npm_flavor`], which content-sniffs the
diff --git a/crates/socket-patch-core/src/vendor/test_support.rs b/crates/socket-patch-core/src/vendor/test_support.rs
index 66a17e0b6..73e7504e2 100644
--- a/crates/socket-patch-core/src/vendor/test_support.rs
+++ b/crates/socket-patch-core/src/vendor/test_support.rs
@@ -458,8 +458,12 @@ pub(crate) fn tree_snapshot(root: &Path) -> std::collections::BTreeMap<String, V
             if p.is_dir() {
                 walk(base, &p, out);
             } else {
+                // `/`-separated keys on every OS, so a caller can name one.
                 out.insert(
-                    p.strip_prefix(base).unwrap().to_string_lossy().into_owned(),
+                    p.strip_prefix(base)
+                        .unwrap()
+                        .to_string_lossy()
+                        .replace('\\', "/"),
                     std::fs::read(&p).unwrap(),
                 );
             }
diff --git a/crates/socket-patch-core/src/vex/discover/maven.rs b/crates/socket-patch-core/src/vex/discover/maven.rs
index 601e156ee..333683d2d 100644
--- a/crates/socket-patch-core/src/vex/discover/maven.rs
+++ b/crates/socket-patch-core/src/vex/discover/maven.rs
@@ -54,9 +54,15 @@
 //! fail-closed pin (no other repository serves it; the Socket repository is
 //! `checksumPolicy=fail`).
 //!
-//! ## Vendored (`vendor::maven_repo`)
+//! ## Vendored, pre-v5 (the retired single-pom backend)
 //!
-//! `vendor_maven` inserts `<id>socket-patch-vendor-<uuid></id>` +
+//! Ledgers written before v5 still carry this wiring until `vendor
+//! --revert` (vendoring such a root is refused as `legacy_maven_root`); v5
+//! vendors every pom root through the JVM planner instead, whose suffixed
+//! pins are attributed through its ledger only (a suffixed pin whose tree
+//! is committed under `.socket/vendor/maven2` is no ref here). The retired
+//! backend inserted
+//! `<id>socket-patch-vendor-<uuid></id>` +
 //! `<url>file://${project.basedir}/.socket/vendor/maven/<uuid></url>` and
 //! leaves the dependency at its ORIGINAL version, so the GAV lives only in
 //! the committed maven2 tree: `.socket/vendor/maven/<uuid>/<g-path>/<a>/<v>/
@@ -1184,16 +1190,22 @@ mod tests {
         hex::encode(Sha1::digest(V_JAR))
     }
 
-    /// A project wired exactly as `vendor_maven` wires it (its own
-    /// `build_repo_edit`), with the committed maven2 tree.
+    /// A project wired exactly as the pre-v5 single-pom backend left it (a
+    /// `<repositories>` section before `</project>`), with the committed
+    /// maven2 tree: VEX still reads such a legacy ledger.
     fn vendored_project(uuid: &str) -> Project {
         let p = Project::new();
-        let wired = crate::vendor::maven_repo::build_repo_edit(
-            &project_pom("1.10.0"),
-            &format!("socket-patch-vendor-{uuid}"),
-            &format!(".socket/vendor/maven/{uuid}"),
-        )
-        .expect("vendor wiring edit");
+        let pom = project_pom("1.10.0");
+        let at = pom.rfind("</project>").expect("project close");
+        let wired = format!(
+            "{}  <repositories>\n    <repository>\n      <id>socket-patch-vendor-{uuid}</id>\n      \
+             <url>file://${{project.basedir}}/.socket/vendor/maven/{uuid}</url>\n      \
+             <releases>\n        <enabled>true</enabled>\n        \
+             <checksumPolicy>fail</checksumPolicy>\n      </releases>\n      <snapshots>\n        \
+             <enabled>false</enabled>\n      </snapshots>\n    </repository>\n  </repositories>\n{}",
+            &pom[..at],
+            &pom[at..]
+        );
         p.write("pom.xml", wired);
         let jar = v_jar_rel(uuid);
         p.write(&jar, V_JAR);
diff --git a/docs/design/maven-vendoring.md b/docs/design/maven-vendoring.md
index 17368ca15..8e0df2b06 100644
--- a/docs/design/maven-vendoring.md
+++ b/docs/design/maven-vendoring.md
@@ -1,13 +1,18 @@
-# Vendored Maven reactors and Gradle in v5
+# Vendored Maven and Gradle in v5
 
 The JVM backend in `crates/socket-patch-core/src/vendor/jvm/` is enabled by
-build shape. No experimental environment variable is required. Maven reactors
+build shape. No experimental environment variable is required. Maven roots
 use suffixed coordinates; Gradle keeps the original coordinates. Both commit a
 local repository so another checkout can build without socket-patch or the
 Socket service.
 
-The existing single-POM backend remains supported. This change adds reactor and
-Gradle support without automatically migrating existing single-POM repositories.
+Every Maven root goes through the reactor planner. A root `pom.xml` with no
+`<modules>` is planned as a reactor of one: the same pin, `.mvn/maven.config`,
+fallback repository and `.socket/vendor/maven2` tree a multi-module reactor
+gets. The pre-v5 single-POM backend (a same-GAV `<repository>` serving
+`.socket/vendor/maven/<uuid>/`) is retired. Its ledger entries can still be
+reverted byte for byte, but vendoring a root whose ledger holds one is
+refused (see `legacy_maven_root` below).
 Hosted Gradle wiring is a separate backend; see
 [ecosystem support](../ecosystems.md#gradle).
 
@@ -49,8 +54,9 @@ against registry checksums.
 ## Maven
 
 Supported reactors have an explicit root `pom.xml` and `<modules>` or
-`<subprojects>` declarations, including declarations in profiles. Run vendoring
-from the reactor root. A discovered ancestor reactor produces `not_build_root`
+`<subprojects>` declarations, including declarations in profiles. A root
+`pom.xml` without them is a reactor of one (#973). Run vendoring from the
+reactor root. A discovered ancestor reactor produces `not_build_root`
 instead of allowing a partial submodule edit.
 
 The patched version is `<base>-socket.<first-eight-uuid-hex>`, matching the patch
@@ -86,7 +92,10 @@ first vendoring run. That option uses the fallback file repository only, is
 recorded in the ledger, and remains in effect on later runs and repair. Revert
 existing auto-config wiring before changing to `none`. Combining `none` with a
 repository ban is refused. Version detection reads wrapper properties only;
-it never executes Maven.
+it never executes Maven. Without a wrapper (most single-module projects) the
+version is unknown, so both `maven_f_outside_root` and `maven_mirror_of_all`
+are reported as `vendor_jvm_degraded` warnings; a Maven Wrapper at 3.9.9 or
+later clears both.
 
 ## Gradle
 
@@ -103,10 +112,14 @@ written, and `repair` refuses there too. A root holding both a `pom.xml` and a
 Gradle build vendors both, in one ledger entry: the Maven half as a one-POM
 reactor (suffixed tree, pin, `maven.config`), the Gradle half as below. A
 refusal of either half writes nothing, and `--check`, `vex`, revert and repair
-always handle both. A single-POM root whose ledger already holds a single-POM
-(`<repository>`) entry stays on the single-POM backend, with a
-`legacy_maven_root` degraded warning that the Gradle build stays unpatched:
-nothing migrates that wiring, so revert and vendor again to wire both builds.
+always handle both.
+
+A root whose ledger still holds a pre-v5 single-POM (`maven_pom_repository`)
+entry is refused whole, alone or beside a Gradle build:
+`vendor_jvm_shape_unsupported` with reason `legacy_maven_root`, and nothing is
+written. That entry's revert restores a whole-file `pom.xml` snapshot, so
+planner edits on the same pom would make it unsafe, and nothing migrates it.
+Run `socket-patch vendor --revert`, then vendor again.
 
 The original GAV is retained under
 `.socket/vendor/gradle/<group-path>/<artifact>/<version>/`, with the jar, the
@@ -227,7 +240,7 @@ tier pins Maven 3.6.3, 3.8.9, 3.9.2, 3.9.16 and 4.0.0-rc-6 (macOS and Windows on
 8.14.3 row; `gradle-compatibility.yml` runs every Gradle version on Linux,
 macOS and Windows nightly.
 
-Automatic single-POM migration, Maven 4 implicit subproject discovery,
-build-time Maven strict pins, creating Gradle verification policy, and online
+Pre-v5 single-POM entries are not migrated: revert them and vendor again.
+Maven 4 implicit subproject discovery, build-time Maven strict pins, creating Gradle verification policy, and online
 dependency-graph resolution checks remain separate work. They are not enabled
 by this release.
diff --git a/docs/design/sbt-support.md b/docs/design/sbt-support.md
index 6d0027112..12b3ca365 100644
--- a/docs/design/sbt-support.md
+++ b/docs/design/sbt-support.md
@@ -205,7 +205,7 @@ Mill builds get agent mode (the Coursier cache crawl) and hosted guidance
 (`redirect_mill_manual_snippet`). `socket-patch vendor` does not wire a Mill
 build: a root with `build.mill`, `build.mill.yaml` or `build.sc` is never a
 scala-cli build, and with no `pom.xml` or Gradle file it is refused
-`vendor_maven_pom_project_missing`. Automatic vendoring is deferred because the
+`vendor_jvm_shape_unsupported` (reason `no_build_file`). Automatic vendoring is deferred because the
 only committable mechanism the probe found has costs socket-patch should not
 impose silently:
 
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 1401cbb47..8e427f7b1 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -19,7 +19,7 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
 | Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry in the root `Cargo.toml` (v5; per-version Socket keys; pre-v5 `.cargo/config*` wiring migrates on re-run) | ✅ per-patch sparse registry (`[registries.socket-patch-<uuid>]` + Cargo.lock source/checksum); direct dependencies only — a crate another dependency also pulls in is refused, use `--mode vendored`; with no `Cargo.lock` the graph is unknown, so only a project whose sole dependency is the patched crate is redirected |
 | RubyGems (`gem`) | ✅ in place | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` twin, which bundler ≥ 2 loads instead, or a `BUNDLE_GEMFILE`-configured manifest makes vendoring refuse with `gemfile_not_loaded` before any write) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` or `Gemfile` + `Gemfile.lock`, whichever the project holds (a `Gemfile` + `gems.rb` twin is refused with `redirect_gem_twin_manifest_ambiguous`: bundler 1.x loads the `Gemfile`, bundler ≥ 2 loads `gems.rb`, and nothing in the project says which bundler installs it; bundler 4's `BUNDLE_LOCKFILE` (environment, app config or global config) naming any other lock is refused with `redirect_gem_bundle_lockfile_unsupported`, as is vendoring with `gemfile_not_loaded`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`; `BUNDLE_GEMFILE` from `.bundle/config` (which outranks the environment, as in bundler), the environment, or the global `~/.bundle/config` / `$BUNDLE_USER_CONFIG` (lowest, as in bundler) is followed when it names the project's `Gemfile` / `gems.rb`, and any other configured manifest is refused with `redirect_gem_bundle_gemfile_unsupported`); a Bundler all-source, exact-source or hostname mirror in app config or the scan environment can capture the patch registry, so the redirect is refused with `redirect_gem_mirror_overrides_source` without printing mirror URLs (scope mirrors to `mirror.https://rubygems.org`; user-global config and mirrors set only in a later install environment are not inspected); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") |
 | Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/<uuid>` + committed `go.sum` pin; see [Go notes](#go-directory-replaces-and-gosum). Paid hosted patches are unsupported; `redirect_golang_unsupported` names the vendored remedy |
-| Maven (`maven`) — Maven and Gradle | ✅ in place in every copy the build consumes: each `~/.m2` copy it reads and each Gradle `files-2.1` copy; `~/.m2` `.sha1`/`.md5` sidecars are rewritten, Gradle copies get advisories; jar-member records swap in the patch service's whole jar — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) and [Gradle](#gradle) | ✅ single-POM repository, suffixed Maven reactor repository, or Gradle 6.8+ same-GAV repository with settings wiring and SHA-256 checks (a root with both `pom.xml` and a Gradle build wires both); see [JVM vendoring](design/maven-vendoring.md) and [Gradle](#gradle) | ✅ fail-closed by a Socket-only `<version>-socket.<hex8>` suffix: pom projects get a pinned `<version>` (`${property}` versions are refused); Gradle 6.8+ builds get an owned settings script, lock-entry rewrites and a resolution tripwire — see [Maven & NuGet caveats](#maven--nuget-caveats) and [Gradle](#gradle) |
+| Maven (`maven`) — Maven and Gradle | ✅ in place in every copy the build consumes: each `~/.m2` copy it reads and each Gradle `files-2.1` copy; `~/.m2` `.sha1`/`.md5` sidecars are rewritten, Gradle copies get advisories; jar-member records swap in the patch service's whole jar — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) and [Gradle](#gradle) | ✅ suffixed Maven repository (`<version>-socket.<hex8>` pin + `.mvn/maven.config` + fallback file repository) for every pom root, single-module or reactor, or Gradle 6.8+ same-GAV repository with settings wiring and SHA-256 checks (a root with both `pom.xml` and a Gradle build wires both); see [JVM vendoring](design/maven-vendoring.md) and [Gradle](#gradle) | ✅ fail-closed by a Socket-only `<version>-socket.<hex8>` suffix: pom projects get a pinned `<version>` (`${property}` versions are refused); Gradle 6.8+ builds get an owned settings script, lock-entry rewrites and a resolution tripwire — see [Maven & NuGet caveats](#maven--nuget-caveats) and [Gradle](#gradle) |
 | sbt / Mill / scala-cli (`maven`) | ✅ Coursier caches (sbt 1.3+, sbt 2, Mill, scala-cli) and Ivy caches (sbt 0.13–1.2, `useCoursier := false`) patched in place, Coursier checksum sidecars resynced — see [Scala build tools](#scala-build-tools-sbt-mill-scala-cli) | ✅ sbt 0.13.18+: generated `socket-patch-vendor.sbt` over the committed suffixed `.socket/vendor/maven2` tree; scala-cli directory builds: owned `socket-patch.scala` + same-GAV `.socket/vendor/coursier` tree (Linux / macOS); Mill: not wired (agent or hosted guidance) | ✅ sbt 0.13.18+: one generated `socket-patch.sbt`, gated on sbt's own `sbt update` records; Mill / scala-cli: paste-able snippets only (`redirect_mill_manual_snippet`, `redirect_scala_cli_manual_snippet`) |
 | NuGet (`nuget`) | ✅ in-place patching deletes `.nupkg.metadata` and advises on the `.nupkg.sha512` tamper-evidence sidecar — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed folder feed + `packageSourceMapping` + `packages.lock.json` contentHash pin | ✅ `nuget.config` source + source-mapping, `packages.lock.json` contentHash rewrite. See the locked-mode note in [Maven & NuGet caveats](#maven--nuget-caveats) |
 | Composer (`composer`) | ✅ in place (`vendor/`) | ✅ `composer.lock` `dist: path` rewrite | ✅ `composer.lock` dist url + shasum rewrite; the entry's `source` and `dist.mirrors` are removed. See [composer-compatibility.md](testing/composer-compatibility.md) |
@@ -505,15 +505,20 @@ Honest limits of the Maven and NuGet flows — documented behavior, not bugs:
   confirmed directory, a POM at a canonical path whose contents disagree with its
   directory (hand-placed, or a legacy upstream POM with mismatched coordinates) reports
   the directory's coordinates.
-* **Warm `~/.m2` shadowing (legacy single-POM vendoring).** Maven consults the *local repository*
-  before any configured `<repository>`, so with vendored mode a warm `~/.m2` copy of the
-  same GAV silently wins over the committed `file://` repository — the build succeeds
-  with **unpatched** bytes. Purge it with:
-  `mvn dependency:purge-local-repository -DmanualInclude=<groupId>:<artifactId>`
-  (the always-on `vendor_maven_local_cache_shadow` warning carries the same one-liner).
-  Reactor vendoring and hosted mode use a suffixed version, so a cached original
-  version cannot shadow it. Audit conflicting copies of that suffix with
-  `vendor --check --local-repo <path>`.
+* **Warm `~/.m2` copies.** Vendored and hosted Maven both pin a suffixed
+  `<version>-socket.<hex8>`, so a cached copy of the original version in `~/.m2` cannot
+  shadow the patch. Audit conflicting copies of that suffix with
+  `vendor --check --local-repo <path>`. A project vendored before v5 (the same-GAV
+  `<repository>` wiring, which a warm `~/.m2` could shadow) is refused with
+  `legacy_maven_root` until you run `socket-patch vendor --revert` and vendor again.
+* **No Maven Wrapper (vendored).** Without `.mvn/wrapper/maven-wrapper.properties` the
+  CLI can't tell which Maven builds the project, so `vendor` warns `vendor_jvm_degraded`
+  twice: `maven_f_outside_root` (Maven 3.9.2–3.9.8 can't read the vendored tree with
+  `-f` from outside the project) and `maven_mirror_of_all` (Maven before 3.9.2 reads the
+  fallback file repository, which a `mirrorOf *` mirror captures). The patch is still
+  applied. To clear them, add a Maven Wrapper pinned to Maven 3.9.9 or later, or make
+  sure your `settings.xml` mirrors exclude `socket-patch-vendor` (for example
+  `<mirrorOf>external:*</mirrorOf>` or `<mirrorOf>*,!socket-patch-vendor</mirrorOf>`).
 * **`mirrorOf` mirrors (hosted Maven).** A `settings.xml` `<mirror>` with
   `<mirrorOf>*</mirrorOf>` (common in corporate environments) reroutes *all* repositories
   — including the injected `socket-patch-<uuid>` repository — through the mirror. Because
diff --git a/docs/migrating-to-v5.md b/docs/migrating-to-v5.md
index fda8e7f22..5c84e522e 100644
--- a/docs/migrating-to-v5.md
+++ b/docs/migrating-to-v5.md
@@ -62,6 +62,55 @@ Remove only the Socket-managed portions of old hooks, preserving other commands:
 Use `socket-patch list` to inspect the remaining patch set. For agent projects,
 run `socket-patch apply` once after migration to confirm the manifest still applies.
 
+## Vendored Maven
+
+v5 vendors every Maven project through the suffixed backend that reactors
+already used. A single-module `pom.xml` is now handled as a reactor of one.
+Vendoring it changes these files:
+
+- `pom.xml`: the dependency's `<version>` becomes `<version>-socket.<hex8>`. A
+  `<dependencyManagement>` pin is added, and a `socket-patch-vendor` fallback
+  `<repository>` inside `<!-- socket-patch:begin -->` / `<!-- socket-patch:end -->`
+  markers.
+- `.mvn/maven.config`: two lines that let Maven 3.9.2+ read the committed tree.
+- `.socket/vendor/maven2/<group-path>/<artifact>/<version>-socket.<hex8>/`: the
+  patched jar, its pom and checksums. This replaces `.socket/vendor/maven/<uuid>/`.
+
+A project vendored before v5 still has the old wiring: a
+`socket-patch-vendor-<uuid>` `<repository>` in `pom.xml` and a
+`maven_pom_repository` entry in `.socket/vendor/state.json`. v5 does not
+migrate it. `vendor`, `scan --mode vendored` and `get --mode vendored` refuse
+that project with `vendor_jvm_shape_unsupported` (reason `legacy_maven_root`)
+and change nothing. Migrate it once:
+
+```sh
+socket-patch vendor --revert   # restores pom.xml byte for byte
+socket-patch vendor            # or: socket-patch scan --mode vendored
+```
+
+`remove`, `rollback` and switching to hosted mode still unwind the old wiring.
+
+`socket-patch vex` attests a single-module project vendored by v5 from
+`.socket/vendor/state.json`, as it already did for reactors. Commit that file:
+without it the suffixed pin is not attested. The pre-v5 `<repository>` wiring
+was also attested from `pom.xml` alone.
+
+Without a Maven Wrapper (`.mvn/wrapper/maven-wrapper.properties`) the CLI can't
+tell which Maven builds the project, so `vendor` reports two
+`vendor_jvm_degraded` warnings, `maven_f_outside_root` and
+`maven_mirror_of_all`. The patch is still applied. To clear them, add a Maven
+Wrapper pinned to Maven 3.9.9 or later. On older Maven, make sure no
+`mirrorOf *` mirror captures the `socket-patch-vendor` repository.
+
+These codes are no longer emitted: `vendor_maven_local_cache_shadow` (a cached
+original version can't shadow the suffixed pin),
+`vendor_maven_multimodule_unsupported`, `vendor_maven_pom_project_missing` and
+`vendor_gradle_unsupported` (a root with no JVM build is now
+`vendor_jvm_shape_unsupported` with reason `no_build_file`),
+`vendor_maven_pom_unreadable`, `vendor_maven_pom_unavailable` and
+`vendor_maven_pom_downloaded`. `legacy_maven_root` is now a refusal for the
+whole root, not a `vendor_jvm_degraded` warning on mixed Maven + Gradle roots.
+
 ## Retired spellings
 
 | Removed | Replacement |
diff --git a/docs/usage.md b/docs/usage.md
index 338b63f17..10355ba31 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -110,12 +110,14 @@ Repair cannot reconstruct a lost vendor ledger. Restore it from version control.
 The N-API crate and in-memory patch engine remain available for hosted GitHub
 App workflows. Removing local vendoring builders does not remove those APIs.
 
-### Maven reactors and Gradle
-
-Maven reactors use suffixed versions in `.socket/vendor/maven2`; Gradle 6.8+
-keeps its coordinates and lockfiles, with settings wiring and a configuration-time
-SHA-256 check. Existing Gradle verification files are updated. Single-POM Maven
-projects retain their existing vendoring behavior.
+### Maven and Gradle
+
+Maven projects, single-module or reactor, use suffixed versions in
+`.socket/vendor/maven2`; Gradle 6.8+ keeps its coordinates and lockfiles, with
+settings wiring and a configuration-time SHA-256 check. Existing Gradle
+verification files are updated. A project vendored before v5 through the
+single-POM `<repository>` wiring must run `socket-patch vendor --revert` before
+vendoring again.
 
 ```sh
 socket-patch vendor --check                       # read-only offline artifact and wiring audit